{
  "id": "bundle--30132fdb-b196-4c18-bd7c-bced882a7970",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--nadsec-dionaea-enricher",
      "created": "2026-05-31T23:56:22Z",
      "modified": "2026-05-31T23:56:22Z",
      "name": "NadSec Dionaea STIX Enricher",
      "identity_class": "system",
      "description": "Automated enrichment from T-Pot Dionaea honeypot Elasticsearch data"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--nadsec-tlp-green",
      "created": "2025-01-01T00:00:00.000Z",
      "definition_type": "tlp",
      "definition": {
        "tlp": "green"
      },
      "name": "TLP:GREEN"
    },
    {
      "created": "2026-05-01T00:05:02.650Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of attacker IPv4 addresses observed by Dionaea honeypots on a T-Pot instance (SMB, MSSQL, HTTP, FTP, etc). Each run looks back the last 1h and appends newly seen IPs for this month. Location: Australia.",
      "id": "report--30132fdb-b196-4c18-bd7c-bced882a7970",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-05-31T22:05:10.052Z",
      "name": "Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--f4087da3-0776-4dcf-83d6-e29bcf9bc87d",
        "indicator--c94d4f92-eeec-42cc-a4bf-f302b30a8329",
        "indicator--1d9296bb-381e-4d4f-956a-058abc514046",
        "indicator--58a1cee7-e7c0-489d-b353-cd2ebe756aec",
        "indicator--361833b2-f290-4eab-a775-1ca6a6e48336",
        "indicator--bcddb3b5-1a58-42e1-9d1e-76c3583d1d34",
        "indicator--f805a635-fb27-4be9-bfee-4ebbbaa82a6b",
        "indicator--495e4692-5043-4b44-a343-2eabc6f48026",
        "indicator--851e8e4e-ebcd-4a63-b8f0-51379c4ad985",
        "indicator--ac3edd71-6bc7-40e3-ba84-eb79bb7a0b1b",
        "indicator--b7b673fb-3a3c-43a8-840b-16661a0a6343",
        "indicator--59ce74f1-a7c9-402b-9317-c01c2778fa0d",
        "indicator--6d82d65b-ea0d-47a2-9d16-4c4326bb860b",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
        "indicator--549217c1-f84d-4cd6-98b4-2d7e014f1033",
        "indicator--43a23d69-8701-47d4-8d86-8afaea18b436",
        "indicator--92e7b3ed-653c-4217-88ce-477c29a7caf5",
        "indicator--fdfc767d-3012-402a-84b1-f55acece7c35",
        "indicator--b64049c1-182d-42a4-9c08-92782c077293",
        "indicator--644666b5-a032-4624-9175-da86c1ba3729",
        "indicator--a2537d33-5997-4c97-a37c-6d3591dd0630",
        "indicator--ff136fdd-d4da-4010-aa28-50a8b37c4b77",
        "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
        "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
        "indicator--8ea34d3c-c7f9-445b-8c6e-c52d93b3429f",
        "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
        "indicator--44a3e561-7aff-4861-8d2f-ede61e2e82d2",
        "indicator--f0dc03fb-1b23-4966-9013-b967f8d1b984",
        "indicator--6e69138a-5438-4adb-a1b3-f468d63c522e",
        "indicator--cc08ac73-f902-4d9f-ae50-a69f01550c4e",
        "indicator--f9c4c21e-2b2b-4f21-aa85-e734a1c82232",
        "indicator--b14d71db-65fc-4a86-a62e-469c0f1f367e",
        "indicator--3d9735df-879b-4019-a3fb-d2c966e4099e",
        "indicator--ef130b56-9060-487c-b4dc-4a7a6bd6e568",
        "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
        "indicator--a9a6b920-36c9-4f66-8990-8c3bb10c9269",
        "indicator--8ae986bb-bcf0-4a2f-bf53-edf47951fffd",
        "indicator--0fa2c768-e83d-4109-929a-c34f226230cf",
        "indicator--64f1ba26-6cca-46c8-82b6-63a3fae9d5a7",
        "indicator--305bf0b6-974a-414e-a967-57b61403f65d",
        "indicator--d1d0d699-e6cf-4155-9f60-fec036734202",
        "indicator--8e71ffee-5471-4ccf-8929-0a64e3c22567",
        "indicator--004562f3-3435-4d02-9220-c40e55934492",
        "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
        "indicator--95b057b1-f33e-4cad-b884-ea1b1d9dcd2f",
        "indicator--f8fdc7d6-16c2-41ce-a6f6-0d0db072d575",
        "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
        "indicator--78209a8a-b0b0-4f6e-97fd-39c2dfd126c3",
        "indicator--f5b669d5-17fd-4f76-a359-0e3e069a8114",
        "indicator--91d6d891-f837-4d53-903c-a08d6e4b0b52",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--3031174d-685c-47cd-8a0f-10fb80c13297",
        "indicator--14e0aab9-ddc5-4eaa-838a-8a1dfb821820",
        "indicator--85de7e57-9c00-4f05-b4fb-e6c8ab751600",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
        "indicator--a02c985f-4493-4416-88d0-a13f0cce4756",
        "indicator--b8d0fddf-74ea-4d90-899b-1410132acbb9",
        "indicator--14365e00-ee22-4b56-8846-525b4c20dcc7",
        "indicator--416de007-bc76-4bf9-a51c-f8ade13ee56b",
        "indicator--93131b20-04b2-4956-bd1b-b0284c7c43c4",
        "indicator--adbef988-1363-430c-a366-edbc47c44aa0",
        "indicator--d11578f8-dc37-4e7c-bf13-41662a7c2447",
        "indicator--fb0feada-6351-4582-ac15-b83bc47c0289",
        "indicator--644f511c-ad18-41de-a645-5310b8d3d4b0",
        "indicator--0704d7be-b3a6-48d9-9b88-344eb49786a5",
        "indicator--0bfb9f0e-65c1-4e20-bd9d-a38eb9ee5279",
        "indicator--aea34727-57cc-4263-881d-028e5b151202",
        "indicator--4ea7e188-c4af-4e3e-a346-69f25a961a24",
        "indicator--f1c8a72b-df47-46c8-b945-c8944eae3a33",
        "indicator--4c41511a-3b22-4e50-a8a6-3944386b89a9",
        "indicator--b361146d-529f-4b72-b6d5-1aa8c078a49c",
        "indicator--8ef57ea5-eb00-436e-b433-807a9ebfd04e",
        "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
        "indicator--ffa3335b-41cc-4926-8316-eb8dcf7a144e",
        "indicator--364dc00d-b531-4692-ab69-6e0974d4e3df",
        "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
        "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
        "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--81622e92-e58f-4443-b940-41bfcb8c908e",
        "indicator--b1280161-3eb6-43da-857f-4326ccdc7b06",
        "indicator--16094e33-2657-4334-9039-03ee4f15fabf",
        "indicator--35818390-bb6e-467b-ba16-b2b44a0e79c2",
        "indicator--00a64800-7b0d-4ff6-882d-7f054edc53b4",
        "indicator--d52f0262-f166-4536-9a45-fe5981be7edb",
        "indicator--f8ef1f19-b447-4cd8-ad7b-2c83a94e8c9c",
        "indicator--cbb0b81e-0416-4a30-a7fa-f71803ed61a9",
        "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
        "indicator--29b3442f-f06a-48d9-9acf-5c1876ccc730",
        "indicator--cebc0e32-8d9c-41f5-b046-781c14cfbe2c",
        "indicator--4d966dbd-d3ba-4526-9892-b30e90064d66",
        "indicator--ed938d28-aeb4-4795-abb9-d3fecb6e0bed",
        "indicator--f116d4ca-669c-48ba-8f44-60c888f4eebb",
        "indicator--3b9029da-b6a8-4e48-9e52-37487ba7c763",
        "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
        "indicator--a273f10f-9da5-4919-ba54-14ab97ccb19b",
        "indicator--d2eac234-db9f-4cb5-b7c8-76dbfcb4dc9a",
        "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
        "indicator--c4ffa596-736f-4ab1-ac2e-2a0416435b7a",
        "indicator--29df78dc-5d9c-403a-bd85-2e105be52f3f",
        "indicator--c7ef3755-2dd2-4e50-b4e0-09751b6f4912",
        "indicator--81012e04-51f5-411b-afe9-68b78baf33cb",
        "indicator--55170144-605c-4026-8788-3f7f9eb009b2",
        "indicator--086bf9db-e094-4ac4-b0ef-c1b22dd7425f",
        "indicator--dc01f7ac-fb03-4d1b-a8e2-27371d09004d",
        "indicator--f8450206-7cc4-4008-81d7-91077407de2e",
        "indicator--013694d9-6b42-4300-8a48-b5bcabd021c5",
        "indicator--12b25a76-45c8-428c-86b1-0b2b07a73327",
        "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
        "indicator--45f7dc4b-c52e-4fc8-9a8e-b524ff66b782",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--06ddbb67-61dc-42e9-81f5-19ca056d14df",
        "indicator--0b806cf4-2933-48b3-b118-189f8eb807f6",
        "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
        "indicator--03a657e1-84a2-4ef6-aeb7-b47d1890f246",
        "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
        "indicator--9b5529a0-2d46-4ca0-9f71-00d3dac48050",
        "indicator--43f9105c-f0f3-4557-906d-37b0b300b877",
        "indicator--f0ce9a3d-f37e-4689-8599-57a1338a9a1d",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--4b1ed4f3-4134-4025-9a50-b83352f4bb68",
        "indicator--cfbde833-c48d-425e-b5e5-26bd035277fa",
        "indicator--97804ff2-6c0d-4a6b-8e0b-2ca023a2a5f5",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--166cc92d-58fc-41bb-8570-5b5b06726323",
        "indicator--e96f9b96-a676-48d3-8250-a994d28fc8d8",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--3c3195c9-6355-4cd5-bdae-2146b5ece70a",
        "indicator--216f28ac-ec98-472f-a2b3-f3e4fc70709f",
        "indicator--6db49d8c-94b7-4925-96ff-116599121978",
        "indicator--67f7fbac-cb4d-49e3-b4e6-af52f6c06fcb",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--737c298e-b791-4da6-b1bc-494a23a45b76",
        "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
        "indicator--584cf865-d0e0-4d3c-9329-d0860fbc0f82",
        "indicator--07243cf2-0793-4c7b-baed-4152f2fe4e80",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--b75bcf58-fbde-4c16-b2c1-5c95c306995f",
        "indicator--a8a18360-02a6-40a3-a704-2882d23b5a0b",
        "indicator--814414b9-2821-4888-9437-f856a98f5dad",
        "indicator--2817f030-a4f3-486f-93d6-9693f5d9fc4d",
        "indicator--85da3d13-e04a-4eea-9a7c-b1e64b628731",
        "indicator--8f07dbd4-1126-4562-9ae3-580fd964c89b",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
        "indicator--806cd735-d8da-4cf2-a93f-fd8ba8dcb922",
        "indicator--d5d8e328-c3bb-424a-8091-c318abf89970",
        "indicator--28e7d3df-eb96-4ec5-b8b3-cd42398c8165",
        "indicator--8dc611dd-03ab-46b5-aeea-f2b5dfa69fa0",
        "indicator--ece11683-82d0-4ed7-83d7-718ebf5c0899",
        "indicator--7cc63782-c963-427d-b6ea-9557be1b95ac",
        "indicator--99f4fa97-c5be-4e1d-8972-2c8264fdfe6a",
        "indicator--df824ff9-8b39-433d-8121-3cefb873ae8f",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--89f62eb1-563d-46c7-be77-b57faaaf7ee1",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--4d8ff91c-38a4-4e70-925d-27e2bdbd6830",
        "indicator--e7f7536b-639d-433a-99bf-6a36d64b71ee",
        "indicator--042c07c1-734a-4d03-8b17-e2ffe654fa38",
        "indicator--4263dd6b-4663-4bcf-8581-c3afad8175c9",
        "indicator--d45c27f7-eb6e-41ea-a59d-5b3ea3c09f7f",
        "indicator--06275e4f-e0a4-4f60-b542-5816589cceb2",
        "indicator--18062449-f1f4-4dbb-9a80-b8769d34e62f",
        "indicator--d2f52842-5c21-43c2-a0c9-375760a275b4",
        "indicator--dafe0464-c7ce-4d58-8d55-e073a4d1a80f",
        "indicator--78b5a1f3-8ec0-438e-97cf-3a5c5fc14509",
        "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
        "indicator--57ba0d53-56f6-4129-a836-b834dcb9c80e",
        "indicator--51924b78-8249-49b8-b167-0020b4d2c584",
        "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
        "indicator--aed061ae-3f1f-4005-b0e6-8e9d4072e1af",
        "indicator--cace4904-a541-4d6c-81b1-095ca4bee20c",
        "indicator--3a99db0a-6d47-4abb-af7b-9e02259f5cdc",
        "indicator--73235425-0299-4de6-bc98-4c2880c52735",
        "indicator--3d98529d-bd00-43e7-af29-5f3d20d6da10",
        "indicator--10b950d9-c7ff-4858-9e0c-8d490e246ae4",
        "indicator--9c0ec28d-2eb1-4f19-a33f-656b4751d456",
        "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
        "indicator--356992cb-6997-48a3-8f00-86d57a1e2dba",
        "indicator--ac3de06c-8570-4fb4-9db9-5c73ad9816ad",
        "indicator--034e9886-ec31-460a-a214-f2107f054229",
        "indicator--de41a027-9ede-4877-9c35-a4914c5cdeb1",
        "indicator--d0acccd8-b5d0-4bbc-98ed-1678efa35438",
        "indicator--05b9427f-a1c1-4969-b25b-b741c16d496e",
        "indicator--8bf5a8b9-f792-4f98-b347-fc94c3ef6e0e",
        "indicator--3ca25064-7cb4-44bc-895a-141741fc94dc",
        "indicator--e064c081-4a6a-4b2a-bfb5-92e8bf6bd138",
        "indicator--94cff398-ecb2-4b01-9021-204bff7ff7c1",
        "indicator--381ef45d-653f-4785-888d-2ef4037ff877",
        "indicator--b8aee76e-259b-4cca-aa4c-89a9336ee2db",
        "indicator--fa5e2fc8-49dc-49a0-ad21-a120e42f5a7c",
        "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
        "indicator--57a8cf03-f4f9-479e-9351-9799a6a7c659",
        "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
        "indicator--decda0bc-85e1-44dc-9342-fb5c7ebfeca8",
        "indicator--1af669c8-e4d7-4ff3-bf6e-d6b54b556f65",
        "indicator--bd8fc033-ab41-4f62-88c9-ff7cde0c2b54",
        "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
        "indicator--b0f66a9d-5cc3-4242-9ab9-b59ef65b1de3",
        "indicator--22a7f4a5-5831-4a45-8aed-7197ea5d78dd",
        "indicator--9142746a-80e6-4e5e-a5e9-4bb8469488c7",
        "indicator--78db4083-d425-4963-ab2e-5167a40cda22",
        "indicator--7e0130ef-95b5-4489-b474-0e40af3035cd",
        "indicator--ec598d0c-6f00-4866-b3d4-e690f15724fb",
        "indicator--80104620-c6cb-4c52-85ec-29d057048557",
        "indicator--36b308a4-54c3-4052-9acb-6c310d94998a",
        "indicator--3f106623-0656-4fb8-b28f-b792ce457f7b",
        "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
        "indicator--bd36a082-d531-4406-97aa-27fe45f6bb79",
        "indicator--6f214f42-137e-4ba8-9787-bf8fe2b8e7de",
        "indicator--2447ff83-3040-4184-a942-b50bbbc81acc",
        "indicator--5a7b9fce-c8ff-42fb-b269-9f553e94c370",
        "indicator--55247113-2db0-4fbe-a0ce-fe12fca9ac6b",
        "indicator--73d42459-85d3-4200-8d1f-1b1753cb5d69",
        "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
        "indicator--8dad4109-4a58-4fd8-b61c-b863b34d0373",
        "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
        "indicator--2edb8226-bfe7-4e23-ab19-c237020ba2c9",
        "indicator--dab4783e-8bc7-4246-98bd-ed590ee21bdd",
        "indicator--64947df5-cb32-4e13-a069-8991e9486466",
        "indicator--6c7dcf48-eb5b-4c3f-be52-4b8eeaf4015c",
        "indicator--32198403-abc6-43ed-8ddd-eb62d9f43890",
        "indicator--7ba0dadb-bdb9-4e38-a2f0-baead280c9f2",
        "indicator--3fa9b898-29d9-4925-8a81-545e08be67c9",
        "indicator--3e7f98a3-344e-489b-b032-223c0a886b3b",
        "indicator--86a042b3-9f81-424a-8a58-b06e9a88eb6e",
        "indicator--badbe13b-2b4c-4a18-9281-0f1ff9086c67",
        "indicator--59829283-0de4-46b4-92d7-f834e531dd06",
        "indicator--15ab9d55-b750-40ce-a43d-4eb19a05cfaf",
        "indicator--ac28825a-1b77-41e1-92c0-77c60a2a3129",
        "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
        "indicator--d4f5bf8d-97f6-4087-9dc2-8671918706af",
        "indicator--8c2f98c3-7080-41cb-8fc4-3f6002181d03",
        "indicator--b3543ef0-060a-4ffc-bf80-d23018658e71",
        "indicator--07e8f896-119d-4895-bdd9-bdfed3fbc757",
        "indicator--666e3e33-ed3b-45d8-9d41-f69f594bd9bf",
        "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
        "indicator--bd8bfaf3-cf8f-41eb-b898-09427d4a1922",
        "indicator--c2c267df-435f-41ae-97cf-2d50e56766d7",
        "indicator--4ce44850-fe1e-48c6-8334-9a0c45fc7df1",
        "indicator--4876dc11-adf1-47bc-8252-b1d18f9fe023",
        "indicator--b3adbf8a-a893-4027-929e-6698b8e9ea3d",
        "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
        "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
        "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
        "indicator--8b41574f-b1f4-4958-9110-d73a2399cbba",
        "indicator--be4f1d22-4742-4b33-a1b1-be71cac258e0",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--297a2296-fa4e-4d40-b598-d46179a38aa7",
        "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
        "indicator--39d6455f-1bb6-4ec1-89ed-cf5872467e21",
        "indicator--7428ce10-2b70-4545-97eb-841054ac9691",
        "indicator--de62ae97-9e90-4f8f-b5b9-c79ef748a826",
        "indicator--c70e2ff9-954c-414e-abc7-16cb0add4ca5",
        "indicator--49fb972e-6544-401e-a93c-25a61e84bc5a",
        "indicator--fbbfc894-d507-4aba-a880-3ff6d0bd5f80",
        "indicator--0d9be2fd-a8d1-45e3-b2e4-1399bf7ad788",
        "indicator--0ce27120-4b94-4439-9069-466a94168c7a",
        "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
        "indicator--19c8d877-6566-49bd-a601-d2becb333abf",
        "indicator--0e00f9da-ae75-4869-8c52-eff9e6416a59",
        "indicator--49cf923f-6047-4c01-a355-0e75764e7a7e",
        "indicator--64541b80-ff2f-40de-bab3-8ab9defdcd30",
        "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
        "indicator--eb7db47b-7370-438e-ad08-63519f8c931b",
        "indicator--72cef475-3686-44ad-a870-d1e60c5b097c",
        "indicator--3c0ad1e1-c98a-4b43-94b8-e0760a00f047",
        "indicator--63f189ef-baa8-4602-8db1-93bf187a0193",
        "indicator--60b7d436-d4cb-4634-a555-39729a921e50",
        "indicator--094f4f4d-4803-4326-b990-30effe7b8c38",
        "indicator--52e4d1c6-f52a-483b-9ae9-813c14add87c",
        "indicator--95922197-b292-4928-aed2-9c2e3b495108",
        "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
        "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
        "indicator--6cdef90f-9f8b-48f9-8b44-70b9d82bc2cd",
        "indicator--37fbc6aa-a135-493e-99e0-cd54fdd5b756",
        "indicator--25f29ee3-8697-4b93-9f49-bcbc3a6ae55c",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--2d507a7c-c4f5-4704-9146-136fdde336cf",
        "indicator--b4b382fe-824b-474c-9f26-c9ce90ab5a7d",
        "indicator--355cf287-6455-4afa-8792-3df2ae75f27b",
        "indicator--701d887f-32a6-411b-9219-490814d36735",
        "indicator--a8c9321f-7eac-4fb8-9f97-fe3d52d04f6a",
        "indicator--d213b242-ffcb-4fab-b173-67a2a7d6e712",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--2a168b7d-12f7-41d2-b3f2-f174c6c883a1",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--e60512a9-cbc4-4043-ba51-3e0bab64de5d",
        "indicator--ba238b03-63ab-4310-a5c4-58ee97d5313a",
        "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
        "indicator--042ae63a-bcb1-4e7b-916a-e25a5581e02f",
        "indicator--79813d75-6c7a-464e-a718-91dbd349c49c",
        "indicator--918f9f70-2735-4d8b-9ad6-d5bdd9694b61",
        "indicator--89706f3c-0e83-4b11-9b80-8372c3cd853f",
        "indicator--853da764-4e23-43d3-be4b-5b9aa1676119",
        "indicator--2f6b27d2-c93e-4f4e-940d-bbed15c9d9f5",
        "indicator--ead5317a-074d-44bb-bfe4-b640fbcf5fd5",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--155b0016-3972-48db-9719-5d5a7ae3df20",
        "indicator--07879074-155b-448f-8625-3bc048cf69e1",
        "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
        "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
        "indicator--eed0c34d-7f76-4474-8cc2-a605dcff0c9d",
        "indicator--151d1eac-db38-41f9-8337-881f13445b51",
        "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
        "indicator--17ba85fb-4b09-4518-b3fd-0cd7407a6fc9",
        "indicator--d9ccea05-d338-4ce4-9c91-84dc48f9011c",
        "indicator--4cf1ddf3-d0a9-46a4-8b51-9f6bbc3a9320",
        "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
        "indicator--b78655a1-a46e-4938-bf52-4a41b384fe78",
        "indicator--e862f2b5-07ae-4f69-baa8-14e79cad5241",
        "indicator--12d6b640-172b-4bbb-9073-567b36269d11",
        "indicator--2a01da51-d2ff-4704-8cd8-b8820cbeb9fe",
        "indicator--c7fe54cb-4a8c-43d9-9893-3643e7fa0d6e",
        "indicator--7af1846e-fb02-433e-96dc-42b5407d4731",
        "indicator--e5afe223-b2ff-4cb3-97f4-2929960c4358",
        "indicator--5963635c-4ff2-4604-a6d5-2526ce7751a5",
        "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
        "indicator--7d5447f7-5a25-4aed-9b7a-a524535b9de3",
        "indicator--912abaa9-0481-4484-aed1-b8e50d097aa5",
        "indicator--bee5baef-fe7c-4993-bb9e-e17310273f17",
        "indicator--0cfaf03a-d2c0-49f7-a3fc-b44bb7cfc777",
        "indicator--e08be4cb-11b5-42cb-bdda-d3fbb9541e8a",
        "indicator--5221a78d-faca-49f8-889c-84bf32b8eda4",
        "indicator--b6b98985-0ebe-4889-ae2a-2de2f8eb7399",
        "indicator--3e61c340-7c8f-4c20-a9a5-087df5c37c62",
        "indicator--cd2e30c8-1ce8-45e9-b3fa-352788ec1bf4",
        "indicator--fb763fbb-1e0a-42d0-9ca7-982cd2e23a6c",
        "indicator--537e4fff-6613-46f4-99d3-ef3d15f1783d",
        "indicator--12bd98b8-cd71-4816-958d-cd3269eac782",
        "indicator--a2aa03f8-008f-44aa-8f0e-156d02c232ab",
        "indicator--106d80af-c243-466d-9365-9578f2fce67c",
        "indicator--0aa8bbb4-23c8-4a2c-bb70-229b0a580f18",
        "indicator--efdb6241-178b-4976-9c83-aac08737951b",
        "indicator--ed6dbdc5-97b0-48f9-bd92-8458649cf366",
        "indicator--736f6315-a26c-47f5-aac3-89690d9edf97",
        "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
        "indicator--a705193d-ccc2-4c51-93b1-3603aded4d05",
        "indicator--347b0eff-c7a2-4c63-b5fe-c41419a82add",
        "indicator--4d89fed2-e906-41d3-8b32-70e111821041",
        "indicator--2768cece-d4d5-4256-af66-e2797141e538",
        "indicator--6bae3587-2e1f-4ae2-8395-0075bbf9558a",
        "indicator--bb6ab765-c241-43da-a27d-c26a40958c64",
        "indicator--9521bcfd-5bdb-43d5-bc15-d5e78c0908c5",
        "indicator--8636d4d6-b3ab-4f48-ac9f-3bd5c1008bc3",
        "indicator--07d863f7-b541-4cd8-a779-5f095da89d9f",
        "indicator--bb958c44-f2cc-4172-95ba-490f8892d536",
        "indicator--ef768eaf-2b17-4307-8a1f-e8c7cd3c1f58",
        "indicator--d5b30679-0fa1-445a-9285-d1fb308b002f",
        "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
        "indicator--9b75d0b9-5229-4200-bd16-0deb2a202316",
        "indicator--c2b4c59b-c3cb-4df3-99fe-f644e255293d",
        "indicator--65670833-3c10-496d-a091-825afdbc54b6",
        "indicator--39bd1c58-e0f2-4af7-b2f8-3881a145f157",
        "indicator--d1f6a82c-45c4-49a4-af7d-5618355c179d",
        "indicator--1c75a434-7397-4925-8a99-975a64d308cb",
        "indicator--36aefe97-98b6-45c6-9d1b-72b3c39f84b7",
        "indicator--39173942-06a0-4c8b-abb8-4cb05a7027b6",
        "indicator--37d9485b-5472-40c5-b15a-ea9c116489dc",
        "indicator--bda317dd-29b5-4b52-aa15-d4faf86f291f",
        "indicator--34cc81c2-03f1-4a10-bb1a-8ca567f01596",
        "indicator--4bc1b8f5-b298-4f34-8b08-1b055ae2f208",
        "indicator--23aaf5d4-a4ab-4742-897c-37a46969874d",
        "indicator--b8e0f525-ac56-444f-b606-a1cc061d78cd",
        "indicator--9ea72ef1-9d51-474d-b378-3e5447de4db4",
        "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
        "indicator--ba38ea62-24af-4422-bef1-493566d4b83d",
        "indicator--f6ef968a-fc8e-466a-9c50-e10f950f9dd9",
        "indicator--d3430560-7773-4bf2-88fa-435015e5161e",
        "indicator--a60879b8-e50c-415e-a618-7293a59e5851",
        "indicator--63928ab9-0177-4dda-afb2-a4e69e4743d1",
        "indicator--d3a61a1d-ac90-4dcd-9a87-59ffea75ddce",
        "indicator--ca88fc30-5a1b-4e1d-8fb2-305740aad95f",
        "indicator--ce6d399a-1cbb-4ad6-bc7e-cee7b5ced971",
        "indicator--b1749e2f-accb-4b88-9d0e-6b37be08b8a2",
        "indicator--56ce9b36-845b-4100-94e4-5b75397b8935",
        "indicator--bc6278cf-c834-4b2e-a2ac-aaed626768f3",
        "indicator--0fe675c5-d6d5-4321-8b5a-a83868376564",
        "indicator--c91d9840-6ab6-4503-9208-a0cb90dd08b2",
        "indicator--3e7a69f2-4dd4-4f2c-a85a-f0b67baf9773",
        "indicator--eac513e9-1ffc-4f8e-8b9e-0bf7b081b02d",
        "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
        "indicator--74564442-648c-448e-9cb9-4dcad34b44ac",
        "indicator--e6e4da75-6e49-4d5d-9f4a-baa5bd57831c",
        "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
        "indicator--a2ef8ef9-7265-41e4-bc40-cd063072f0e3",
        "indicator--02233260-9932-4056-b92c-67fcac37ef9a",
        "indicator--3986cc22-3e53-49c0-8b8d-417ec5b90a56",
        "indicator--6a0cfba4-3e42-4d7f-93b6-a771a5053709",
        "indicator--7d13bf99-3cc5-45d6-862f-89c884e64f23",
        "indicator--326e2c3c-41bb-4e7a-b159-7a1c884f6d0a",
        "indicator--e47f7991-9e22-4446-a2b6-3ab715dd58e2",
        "indicator--5247cd0d-0bc7-4467-bd8d-d49879fd7de9",
        "indicator--e59c68c9-cc0e-427f-bb79-7258e15e9d0c",
        "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
        "indicator--37076e74-ea5b-424a-b7ff-525836972a59",
        "indicator--5ef1cd45-cbb2-464e-a3b0-26ea78e0b925",
        "indicator--b42272d5-cf25-48c1-9220-2ffd451cacab",
        "indicator--8ffeb959-8228-4050-851e-f0f55d7540e0",
        "indicator--ca07831a-ebff-4518-acfa-9954d1e10360",
        "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
        "indicator--0583ce09-d488-4c3d-abc0-9a3eec0cecb1",
        "indicator--00480e94-68f3-455f-9eb9-ba033878afc4",
        "indicator--1e958029-fef7-46b3-9af9-8b72b9e5e50c",
        "indicator--b81e65de-3473-4f1b-8d9e-2153d1915435",
        "indicator--bfae77f7-efb8-4156-a899-2c5c964ef309",
        "indicator--786241da-260a-4072-a90c-2b4ee8cc4bb7",
        "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
        "indicator--cf249ae9-1ae4-4a9d-b09a-495c41a2f6b5",
        "indicator--c5bdec3f-6172-4274-acf9-3a007a2db1e4",
        "indicator--2b6fb025-8e4a-40d1-a002-fb542cac9d59",
        "indicator--f5e988e6-835b-4f73-9ceb-5e726b394aea",
        "indicator--a0a649fd-dd82-41c9-a002-9b3373b4bd60",
        "indicator--a06b0608-4886-4f58-a792-1f8efd0a3345",
        "indicator--17a2d0e7-0622-4e23-b368-1a0246b29f3e",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--83f87abe-7a6e-4b76-9bdd-07818e6d84bf",
        "indicator--3eee48b0-e910-406b-8804-3da66f877d67",
        "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
        "indicator--c2ad7f7b-3a2b-4289-a9aa-010599c19336",
        "indicator--1226c05c-6951-4e6a-b6bd-5faa7367ad2f",
        "indicator--11c15d64-b857-4685-8545-843d3c5029c9",
        "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
        "indicator--703a5ba5-b1d1-4cd4-b7fd-e47df7edd98f",
        "indicator--d5978b06-5f67-405b-b9df-18d14217ea88",
        "indicator--d06ee34a-9df9-4967-87d7-765e0c624e17",
        "indicator--ab3cde26-7100-4af2-9009-f550eb76744d",
        "indicator--393ade05-09ea-4d0f-8981-20791a03e57e",
        "indicator--e16ade22-9edc-4d70-be0f-61ab268a03c5",
        "indicator--f4e244ce-8d18-4189-9aa4-afb7fdda54e2",
        "indicator--6632b7db-fcec-47d3-8122-1d738dd44fa3",
        "indicator--39bfb757-c089-4cc9-a42a-b90eeb5c3cc1",
        "indicator--a5df3e8c-6060-40c9-8693-ef80cb669d5a",
        "indicator--1719b150-3148-4c0c-8f37-c39f717da397",
        "indicator--2d4b8455-841f-40f0-bd04-28519034dab8",
        "indicator--8bf2a44a-7cb7-4b95-b0b7-1ebd0b826ce4",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--8d6cb90a-561e-4dad-873a-6b7ef768d103",
        "indicator--f3d7daf1-5437-4c5f-87d0-91a78d7368db",
        "indicator--34953cfe-353e-4f40-9db2-64f2ed9168c4",
        "indicator--e8136260-3f4f-4a7e-8c07-091c53f7813a",
        "indicator--7287af32-b684-4715-b218-8ea60008e92f",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--94c4918d-dd3b-4523-a586-cdb025fd414d",
        "indicator--a1568a53-83a4-4d56-aaec-9bf797dc8b35",
        "indicator--a67b35fc-cbad-40e6-b6f5-0d7b2de88281",
        "indicator--27c2eb68-2eea-4d57-b97f-fa2baf3c6404",
        "indicator--ac3311fa-89ec-4753-be08-cb6eedf08f55",
        "indicator--ee8dc2bd-acc8-4279-9d0d-0674e993f96c",
        "indicator--2583cd5e-c79f-4489-975a-8b2bed3e955c",
        "indicator--70295adf-058c-4a27-98f2-131c8e285015",
        "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
        "indicator--3231a295-d22d-4121-a1c3-c5f1a813a440",
        "indicator--8931c6f2-1806-4d05-9b20-d8b1c53761a4",
        "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
        "indicator--cacc9598-d4d9-4fe3-9e69-450503f2ed05",
        "indicator--1b73391f-a578-41ad-9fe0-f0a8b36b7f65",
        "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
        "indicator--5062a79b-b85f-4d42-8cd8-ed3b120753ef",
        "indicator--be621ce7-d110-491b-982c-2df9ba7c3fc7",
        "indicator--fb7c07d3-f96e-4d04-a2f2-fb07778db5b3",
        "indicator--07c289a9-6c78-4ab4-9498-f5aaae152185",
        "indicator--13ec7ea3-7768-41a1-b251-7bdd09f54f0f",
        "indicator--9959bc36-7996-4dbe-9aff-03f5e85d92d1",
        "indicator--f0ffea1b-15ac-4152-9c93-2f9d4ce011e0",
        "indicator--0639229f-51ae-4c27-8210-bb5f7844dee1",
        "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
        "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
        "indicator--37e673be-b947-4dff-92fd-1cc83bcffb8c",
        "indicator--fc6a62d4-3621-4c46-880e-6dafe987491c",
        "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
        "indicator--3fe5b0c7-a4aa-4f61-80a0-a32780a004ba",
        "indicator--003e65a9-34ad-4f91-89b2-41a822bd566c",
        "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
        "indicator--7c5a24cd-6ea7-4ac3-b8e9-9b550769cac6",
        "indicator--b5c39848-83fa-4911-a9b2-89bb6553f807",
        "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
        "indicator--81e6c608-c640-4889-9b5b-971c1f84efee",
        "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
        "indicator--61b4f97f-0dd4-4358-b138-d76bbe9f83e6",
        "indicator--6f81ab7a-8b30-4823-9f4a-61bfcc0144b4",
        "indicator--70dd3e90-0065-4b98-8390-ac77a4f66630",
        "indicator--b4f0777e-7209-4031-853d-6f5af8d8436b",
        "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
        "indicator--0cc25d64-e498-465d-8058-7ead53f5e0eb",
        "indicator--8b26d3ab-bea6-4346-ba6c-887889b7ebd9",
        "indicator--bc8d371e-1c78-4ed8-a1c0-2166b67b947a",
        "indicator--8db85ef7-512f-4ab9-84aa-d796807bb594",
        "indicator--ee94b310-1e82-430b-b687-09a83107ddae",
        "indicator--4f313847-9e3e-4933-a4ba-dce7d8b549ac",
        "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
        "indicator--990b72a3-a475-41aa-a0e7-9333ab493616",
        "indicator--52e059ff-e940-4701-9f3a-854a87ab3744",
        "indicator--90f0f14f-3f26-4acd-b0a7-a54ca9f96515",
        "indicator--12369dce-846f-4287-ab34-02993b717d9b",
        "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
        "indicator--71fa9a05-b14e-4624-bbd6-17cd74b2bd1d",
        "indicator--a3f6cd8d-1163-4b8e-8c88-1130252612f9",
        "indicator--8b043326-3050-444a-8f7f-d7da8f7e6732",
        "indicator--1d463952-667b-4259-83c5-de0284fbcc17",
        "indicator--60fb8536-e840-40b4-9b4e-acf53f2cfa99",
        "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
        "indicator--07cde71b-42a5-4584-b802-481d49fb4dcd",
        "indicator--d93e7555-653f-431d-833e-7c223021417c",
        "indicator--e7c9860f-4b23-47d1-a24d-d9ff3b4882be",
        "indicator--ae502d69-10aa-44b7-8a6c-59c22c67f2fb",
        "indicator--11844ce7-c0ee-48d0-b27e-a8e6e12a8ead",
        "indicator--ebe4dd08-768f-401f-8f28-45cd8d01b12d",
        "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
        "indicator--9f7b719b-77a5-49e8-ae10-3bfc87599b02",
        "indicator--092f8378-5411-4790-a4df-ccfc23817bda",
        "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
        "indicator--db713fa9-f38f-49db-a1f0-10be71522e52",
        "indicator--045fb830-b5a4-471a-ab87-fe8de9dcb34d",
        "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
        "indicator--f40fcd60-e4ae-4d2d-8ba9-d385d3fb2f39",
        "indicator--ec6c87ad-652c-453f-badc-1dcc15e37fab",
        "indicator--ae2cf2fc-d7e2-4418-97d2-3c8bc85d2871",
        "indicator--8ae02f84-9bc0-4d70-b65a-52794d84cfed",
        "indicator--e8b8c8d6-e915-4af5-bd6b-1c85b931eb97",
        "indicator--40079a0c-b66d-4f04-9d88-a20d2108711a",
        "indicator--57f0800f-810a-4829-8448-3257052b98f5",
        "indicator--c7acc53e-b4fe-4002-9d0a-79bd33bb419a",
        "indicator--09812197-ef1b-445f-8e35-63520c8cf11f",
        "indicator--c1583308-06cb-4745-83be-7630f1bcb62d",
        "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
        "indicator--ba27dac5-5c81-4177-a132-ca734d1b777e",
        "indicator--035ec22c-2e6e-4db9-bd49-b6b9639f73e9",
        "indicator--7f632eb2-f464-40be-9776-2b7068c7c920",
        "indicator--61b96cc8-1a20-48ae-bfff-06508e686f30",
        "indicator--4c61c53f-d00a-4276-8755-e9cf1723fd0b",
        "indicator--235e044d-147f-495b-941a-31aaf73bccb0",
        "indicator--893e74eb-35a2-4f33-8c73-12ebe4197d19",
        "indicator--5b5e6363-3bdb-435a-89da-6a2177cca59d",
        "indicator--730ebfa2-bfc7-426b-8e2e-0aeada8efaec",
        "indicator--703cbe1d-3d51-427a-965e-4cd111da2d6a",
        "indicator--d616489e-d714-40ad-a552-abbad76c0a27",
        "indicator--7c260ca0-54a5-4239-8f91-ed1fffcdada8",
        "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
        "indicator--75c410b8-ffce-44b0-8bbb-56992b4474d6",
        "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
        "indicator--ab5e27f1-4aa7-4fb3-9a7e-81595921166f",
        "indicator--2b762749-c644-40d9-b162-e8b9faeab119",
        "indicator--635e3a71-2c1d-44ee-9905-6411648494a5",
        "indicator--2d2b36a5-1750-46d1-b6e8-a6840da3b053",
        "indicator--bb036ec5-3466-4dae-9baa-d062ca174578",
        "indicator--beb3c89a-40aa-425d-b77b-c932585f5d34",
        "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
        "indicator--491ce209-92f4-4ca2-90cc-05e03bfc22c6",
        "indicator--55ba95f9-ad62-480d-adb5-aa963f4f2cfb",
        "indicator--ff23ddcf-86de-42bf-99f8-a0000f4fbf54",
        "indicator--842c0a2c-f0cf-4c2d-ae4d-8b5367580a1a",
        "indicator--03162b09-9cdc-4a44-9c10-c5396bd611f7",
        "indicator--59d60707-7782-4499-9ab3-854296f1e954",
        "indicator--d3e6338e-f0be-4b91-b21e-3e348c498769",
        "indicator--9162602d-3d24-4d4a-9ab2-a96d16b8ab06",
        "indicator--f7c17cc7-d8e6-4a3b-832b-4e8e704efd4f",
        "indicator--a513abf8-89d8-49cf-988e-cbed1afa1f39",
        "indicator--68b4317a-598e-4117-ba81-75a9e70f48c5",
        "indicator--5e83d553-6c92-4bc5-bb40-1ac4e69f5a65",
        "indicator--efe55801-d519-4eeb-98d8-6aac4a1ff224",
        "indicator--4eb411dc-e8a0-46e3-9208-27abdc9244ef",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--c7e00175-22ca-4aa7-8d36-188087856731",
        "indicator--051a3fe8-db38-487b-86af-c46c311daecd",
        "indicator--77866f86-b553-4864-9d8e-caa1f1848b10",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--6b9296e7-5daf-42f9-a48c-543f090fc5d6",
        "indicator--25b16f2c-5843-4394-b415-dc751882dbd6",
        "indicator--d2bdfe10-5b54-4b91-8101-2269c4f36a1c",
        "indicator--55800b96-b538-4029-b919-408a25566b20",
        "indicator--2af86355-44f9-4f83-a1f6-071adb14daa2",
        "indicator--4a2cd920-1a69-4bfd-a903-8cf7ad6afd76",
        "indicator--1ea686b6-cc66-45df-b2ab-c03ccf867768",
        "indicator--ffb3bac5-32ca-434b-84fa-46600d3e3106",
        "indicator--fdc86e46-5170-492c-a4f4-126144b135c3",
        "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--2c241a12-956e-455a-810b-134cd0e9fc81",
        "indicator--081cf61c-8a6c-42cf-b500-ecc3c6d20b7e",
        "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
        "indicator--5fce842f-4ea4-42ad-b34c-15ecdb57e9a8",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--2243b288-c1df-4558-bf89-cfd48c1879ab",
        "indicator--92eebc11-ef87-426b-bdc0-f101cda1d4d6",
        "indicator--f41b67e4-0775-4284-97c8-dd16a90826c4",
        "indicator--a78b365c-a69a-4e0b-a08a-30877d2d5def",
        "indicator--8fd4d7df-d123-4912-b473-48993f143449",
        "indicator--3a2d19df-db79-4e99-b879-0f0a0acbd5d2",
        "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
        "indicator--7f5db671-bb45-4a52-be31-98fb8d355bb3",
        "indicator--8378a1c3-ac1e-4332-8a6b-d3609f44404b",
        "indicator--de72fba4-97d9-49dd-b2b8-edd6cf8d4289",
        "indicator--80275814-4565-43b8-96ed-07ee48e58be8",
        "indicator--9f723794-98a4-4c92-a62e-88e321430ace",
        "indicator--fde2da7c-7a18-4eee-bfb4-5434249f1534",
        "indicator--c573dbb6-1da6-4054-b1ea-aa2ae1ed595a",
        "indicator--012a5f04-576e-4a3e-8e5d-bdcce8201678",
        "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
        "indicator--cccbcd53-3e90-41c5-9523-0225d6dfbc3d",
        "indicator--12a745cb-ad2e-421e-90d7-0e7c555ce761",
        "indicator--53547410-363b-41de-bbeb-16c9bff088bc",
        "indicator--d0b612a9-a934-4a11-baa3-ba071b3c0510",
        "indicator--cc12b759-db95-42dd-98bf-14110f391246",
        "indicator--8983a4a0-54a7-4fb1-a51f-04504dfc8c8f",
        "indicator--267a773a-095d-42d3-b5fd-ce0a9e5a1e50",
        "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
        "indicator--0253b16c-fac2-4294-88a5-5447fb52a140",
        "indicator--523f21f4-fa64-4a26-a7ab-ae3146303539",
        "indicator--0b2900fd-1315-4ac3-9cfc-612940a3875f",
        "indicator--334a5931-0c5c-44c6-996a-a799c8daf5b0",
        "indicator--ef65348f-535b-4db2-afcd-b81db3294a21",
        "indicator--7ef768e5-5bed-46f6-9740-fe431cff8cfe",
        "indicator--b38e95b1-e67a-4a02-a214-0524b8728f4f",
        "indicator--092b3c4a-e8d1-493f-aefa-4ca3991ecba2",
        "indicator--a06d57a3-6d69-47db-8d9c-2a46d5bc8192",
        "indicator--b8e9a6e6-955a-4882-9ff4-e4917c79acc2",
        "indicator--ccba7059-ad95-475a-a12a-48d1e75a1dc7",
        "indicator--e0df549b-603f-4ade-b71d-32026392849b",
        "indicator--eca660fe-5330-436c-a53d-72faf7707940",
        "indicator--e61e7c3e-3b31-4f4f-aef7-607b118ad8f1",
        "indicator--4d2b306b-24f7-4d70-a730-13120db63d1c",
        "indicator--67cbf654-8ac3-4bf0-a194-c6a0236ce9d6",
        "indicator--b0883da9-23b2-4bde-84c9-ef9a1a4fe331",
        "indicator--7780fc15-a51c-40c0-ace9-1954362a4ba3",
        "indicator--e45148c0-95d2-432a-a43a-938d5c89e308",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--29cf73a4-b3cf-4936-b5e1-a1e068a31328",
        "indicator--6732c885-62a4-4ee1-916f-9ff27e35f687",
        "indicator--88f30cb2-5890-4706-a057-deb56fba9d39",
        "indicator--7344e890-d989-4542-9325-c1ec420ff437",
        "indicator--6b7426b1-b923-4cca-981e-2e206094c2d3",
        "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
        "indicator--3f26ffde-cb04-468e-aa3f-55141b864b7e",
        "indicator--c2a53c02-d943-4f1d-ac7d-15d76da1428a",
        "indicator--aabe07d6-fe27-4d1d-88b1-a7f12ed7ac5b",
        "indicator--ccfbcdaa-4405-41c4-a453-d90161eda084",
        "indicator--52c8643a-bd1c-4ea8-bd12-6be513c27f4a",
        "indicator--8e1cfcd5-7ae1-4fd6-8700-4c444a099855",
        "indicator--54b368b7-6a92-48cd-a6f9-d7ada7806f66",
        "indicator--b1b06d77-a010-409c-a80d-702af7f0216e",
        "indicator--fa7d2886-e9b0-454d-ba52-fb59a71139a9",
        "indicator--d863abbb-dc26-4d72-8487-953c4d9a99b5",
        "indicator--9fe949a1-79ba-4ad8-bf32-7d0a22d502e6",
        "indicator--b651b6c4-d125-4e88-a577-8e998d259af5",
        "indicator--bdec3ae6-ce40-4cb0-8824-190052e251fc",
        "indicator--108203b8-d5a7-48ed-9ed2-1810d271c718",
        "indicator--b53473f1-e798-42d1-abd8-924e04b1b98c",
        "indicator--76fb42b3-7eb3-41e8-841c-c14c39ab44d2",
        "indicator--7f8f2bae-859e-4199-99d9-aef2014511d0",
        "indicator--42804fc7-2562-4585-a8ba-4e6f983ec324",
        "indicator--e69b6cf6-96d9-43d1-b5f8-5e80e0cc464f",
        "indicator--8894bdcc-5bbc-4fab-8ef0-7bcd8eab697a",
        "indicator--556a9ae7-99bc-453e-acb8-72d4a1561188",
        "indicator--e8dd2f5b-46a7-4f84-8517-4f6fd5477c4c",
        "indicator--01750c65-bf1f-4d0e-a68c-c9d92ce0af5b",
        "indicator--562b96a3-5f42-414d-a73d-b7dca7a7a950",
        "indicator--7e8ddc6d-ee15-4a8c-8f80-a877990c0279",
        "indicator--dd47b6a0-2a37-48cb-89f1-d53f95efeb59",
        "indicator--b4de338a-860e-47b2-b529-39bdc028112e",
        "indicator--0019fe01-03d4-422b-ba83-14e0f10b0bb2",
        "indicator--87fa00e9-90ff-4f1e-a987-2b583ec0d108",
        "indicator--2907082e-375c-43ec-806e-02486d9e50ba",
        "indicator--735ccbd5-1214-4bce-8953-fdfa3a290e6b",
        "indicator--4da16b23-a050-4526-8d7b-6c6da08ce202",
        "indicator--36afb7da-5833-4a6a-8edf-b24fbdc03e1e",
        "indicator--e09fa7cf-c404-4c30-84c3-0bb61e7aef37",
        "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
        "indicator--49bf36be-cc7a-4346-8d79-28c0a0efbb2d",
        "indicator--cb974137-615d-4f1b-bfbc-df376c0e17b0",
        "indicator--7a9376d2-59b7-44f4-b69a-5d5a3f769062",
        "indicator--476123b0-727d-411b-ae11-feaf2b68ae73",
        "indicator--43e9eae1-91c5-40ba-9e54-3a1cf284e899",
        "indicator--854fc60e-8476-47fc-8f39-74d3fe1369a3",
        "indicator--fee0cf16-01e2-4c04-b4a1-6f0df9a06262",
        "indicator--574bdb59-a8b9-4903-93b1-d0c2bf280f1b",
        "indicator--4dbf2de2-9238-45fb-bf44-c5ccea93ead8",
        "indicator--183d1a2b-f451-4c4d-b26e-64e4b19b1468",
        "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
        "indicator--86185a1d-5fcd-4c49-886f-166b808bb805",
        "indicator--89a6cabf-24f9-45b9-9a6d-503adf8f56d2",
        "indicator--5799d0ae-1497-47ff-afaf-bffe520daf2c",
        "indicator--18b94203-af2b-4fc5-9aff-4dfc5773222c",
        "indicator--ac59adf1-9a48-4e61-8946-be96ad55166e",
        "indicator--36aff66c-644e-4830-b407-284f9e017b78",
        "indicator--ee360776-cbf9-4d0e-9ea0-16c36daa3a3a",
        "indicator--e40335bc-d5ea-431b-8ad2-0b726a5bf78f",
        "indicator--b61a4f40-e529-4d6f-bfa4-5df74b609701",
        "indicator--eb5fc83b-44fa-45a2-9154-47bd7412911a",
        "indicator--c77cd7a0-8100-4308-b625-7ee6f41a1f76",
        "indicator--d2262fa7-e724-42b0-b000-7d19e199e561",
        "indicator--933e7eb6-2106-4071-ae63-b13be35bd68a",
        "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
        "indicator--b4c8499f-098f-4aec-a30d-ad0770401dc8",
        "indicator--cab73685-1149-49ea-9d06-b05459390f1e",
        "indicator--f0e755ac-c2b8-4d9f-98ef-996234fdff92",
        "indicator--8efa281d-1970-4b97-a0ec-e940166b0d7b",
        "indicator--32107618-4db0-4cd8-89c6-8a951ba5cb78",
        "indicator--6e137a90-c70a-4d00-8bc0-903e73578004",
        "indicator--80ffbae1-1c20-453e-b850-f5d1e6d761db",
        "indicator--16e4b43b-2f20-427b-9031-e527409eba19",
        "indicator--7b3190b5-8fd3-4205-aa47-d705e0c4d690",
        "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
        "indicator--6e80d481-9d93-4a1c-a630-0e9db926541a",
        "indicator--0bc4cec3-6e04-4092-960c-7eec9005cb78",
        "indicator--cd655c1b-c6b6-45e7-b470-9798bb4542f9",
        "indicator--d1078245-1d83-43ba-97b1-1b6e82e6cf56",
        "indicator--f1372e31-9013-43f2-a30d-becdc04339dc",
        "indicator--23c0e314-9cbd-4f6b-890c-4f962e46bc35",
        "indicator--ca9c4987-51a2-4bfc-83ac-b2c299c2eaba",
        "indicator--bf1982a2-68f5-4451-ac53-9b4898247edf",
        "indicator--32d39242-ab94-43f4-887b-ed37f15c88e9",
        "indicator--f7921562-a9db-4916-9db5-f6d85004c318",
        "indicator--b9a9b498-8651-42c4-8d6e-22483ad8c0ce",
        "indicator--3daad0a4-ee9d-4fa0-9ed0-258a891ceed4",
        "indicator--3e074dcc-8266-4629-abae-971754e58a66",
        "indicator--9c2e5d1f-3ee0-4eef-891b-58d1fc6b852e",
        "indicator--dd293e37-6576-4e99-9d08-c5287ae73a35",
        "indicator--3f333269-f9ee-4a69-b06f-2207f6d83390",
        "indicator--83512980-1927-4882-b837-4b704548a82c",
        "indicator--c3ce7385-b12e-47d9-8a18-23b77b482eab",
        "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
        "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
        "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
        "indicator--77f29de8-e787-495e-a61c-7ce452a57e3b",
        "indicator--ebd17a42-6086-4a5b-a4e9-9eac96845c2a",
        "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
        "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
        "indicator--39b57656-b73b-4b51-81b7-5e1b6ef20327",
        "indicator--63def225-818e-4c67-acda-89ab5b6d5c89",
        "indicator--fa307cff-b768-4b41-a236-d356d4268967",
        "indicator--1cc12528-ce54-4fa4-9fde-7f0ac2ac72c8",
        "indicator--c51a3fea-76f7-49c0-aa3d-1fff794e6077",
        "indicator--01731537-9b88-4be2-baea-c6fa3f4f3ee9",
        "indicator--dafb893f-c158-4170-a349-4253ab7a789c",
        "indicator--d2533351-c9a2-4280-9356-8d3520b37e4a",
        "indicator--4b302297-6401-4e12-8d7e-c5500d5fb222",
        "indicator--e1e6e3f8-e643-4a87-b715-35187adcf16c",
        "indicator--ea252d1b-cea8-48c2-b003-d007d284de0e",
        "indicator--b4f06806-5556-46a6-bc3b-7113744145db",
        "indicator--32564c07-3418-4663-a9c5-ccb99a1f7500",
        "indicator--ed5d2a42-8b60-488d-8c56-73a09ac5e601",
        "indicator--41e564b0-91c6-47c3-b472-09516b07bcf0",
        "indicator--ebe3f48a-5054-46d6-a44e-34579acd4abe",
        "indicator--e83909fb-cc4e-4ac6-84bd-84ae9bf82ab0",
        "indicator--57604121-45a2-46c7-a4a4-24dce9715ff6",
        "indicator--075a4a57-70da-47fe-9ef9-fd763948a028",
        "indicator--508c86fe-d0d4-429c-aef4-931a6911118e",
        "indicator--c355e299-335c-41ee-a054-a70b5e70e7bb",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--dcfc7eff-9f92-4e15-93bb-f22f4696c3ce",
        "indicator--1bb295e9-12c9-4fd9-872c-4ffa833c91c1",
        "indicator--b4e53573-b96e-4dfb-aad4-dc2ec77eb6a7",
        "indicator--5cf49f30-b480-4e30-ad7c-e3df116c9c65",
        "indicator--4a9041e0-3a44-476a-8370-2a323523bea3",
        "indicator--32b32c4a-a38d-4d21-a883-4b2f6bed6ccd",
        "indicator--4e3ab079-946e-4db5-a9a0-61704b51706b",
        "indicator--b63bc71e-3277-4055-97c1-9d598405e72a",
        "indicator--08acf91c-c26f-4c00-9b61-e389ac125046",
        "indicator--02b4da24-bfb9-47ec-aed2-656008d46523",
        "indicator--36119191-66a5-4ba7-9117-a93a516a4f9c",
        "indicator--70618f04-dcb8-4cfa-bf92-c9add9e99907",
        "indicator--19a91643-038a-4380-884b-5b6f33c7a326",
        "indicator--0b406edc-f69f-482e-b7c5-4f3873b0d937",
        "indicator--a071f222-f622-4686-983a-3955b0de2df5",
        "indicator--aa5553e1-9719-4d72-9dc8-43a95d6698a2",
        "indicator--966b8d55-4bcd-4865-83dc-7e5a9f7e93d2",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--067bb73f-f3b1-4234-a3c3-d435b3fd53e5",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--0e5018fa-1899-428b-bf9b-eabf9cdf592d",
        "indicator--145b541b-4da9-47a9-ad78-bc0e3d43480e",
        "indicator--8c229e4b-4b79-4967-857a-b0472bb8189a",
        "indicator--0eb083f5-4a01-420c-9287-dff6ff372df6",
        "indicator--3151fd99-b71c-4c52-9735-35d02808e487",
        "indicator--c135518a-5230-4acc-b1a6-7f886e351a43",
        "indicator--15b797fa-0a04-4d44-b6a9-0a4596968fc8",
        "indicator--9dc1202a-b53d-41fa-bcc0-e134a1c8c5e5",
        "indicator--be6109af-f42b-4164-944e-7fc7bb6e9a57",
        "indicator--6572769e-0d23-49f6-895f-2a122f886253",
        "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
        "indicator--59418965-21f5-480f-bdd0-143e1cbad69a",
        "indicator--9c1098f3-f790-40c6-b821-efed09c35d86",
        "indicator--aa477a97-f019-4b55-97bd-f57e6a938336",
        "indicator--e68e9519-5533-47e5-9aef-f4a024f48c25",
        "indicator--dfe2b647-3324-48e2-b144-fa30b063e227",
        "indicator--443c9f7e-0c7a-432d-97bf-30e20ea91b97",
        "indicator--41fd2789-0810-4f0c-8c76-2981c80e62f7",
        "indicator--34801dcc-feaa-4b6d-9bff-5c72d427ee19",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--2da68240-ffa9-449b-9ebb-eea9c233a87c",
        "indicator--2e714f28-9a9f-40f0-874f-7fd901d966c9",
        "indicator--6a87644f-fefe-4ada-8575-61fe947742be",
        "indicator--bb26a76e-5434-489c-946c-43d6b291df3d",
        "indicator--0c0769ba-35b2-4f45-b3f9-42d81d40fd8c",
        "indicator--f46ce20a-65f7-4b66-8ba6-a7777c2753ea",
        "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
        "indicator--03380237-be83-4b82-b87e-c3c633be6615",
        "indicator--b22907a5-9403-4e93-b2af-4d4788cce400",
        "indicator--213bb2d8-8c08-47d7-8ec2-8c323dc58436",
        "indicator--6aadb73c-74a1-4cbd-9f1f-580cfaab8737",
        "indicator--e20dedb9-6938-46a4-926c-f78600505df0",
        "indicator--496d3a4d-3c9f-4fa8-aa2d-6aac3c85b562",
        "indicator--214ae1be-0c24-4142-8551-496f2a092ff4",
        "indicator--b965f4b7-8842-4600-9f71-b8b664a58ab4",
        "indicator--f4995780-fa98-40f9-b48e-94349a4462a9",
        "indicator--84ecc34b-dbad-4f05-8d92-0da9d9158292",
        "indicator--7c40d208-a0b6-4087-bf49-6d1c2ceafd44",
        "indicator--ef72d438-f868-4a0f-b423-daffd8978ea4",
        "indicator--c8ce7a9e-11d2-4642-9a4e-98d93c39112d",
        "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
        "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
        "indicator--f366ca98-7603-4e7c-b87e-e94963b72e16",
        "indicator--3ef5d8d1-7750-4787-ba11-63252493644b",
        "indicator--c75f5408-9d18-48b4-ab9e-5578c620d663",
        "indicator--c4c0ae58-7ade-4ac7-b11d-2631ddda56eb",
        "indicator--f3274f03-f34f-4f3c-a7be-ffbfdc4de17e",
        "indicator--3e2defeb-4d9f-43b8-9a55-c1cf5221b878",
        "indicator--618334f8-f4b8-4722-961d-3b1b3f892c97",
        "indicator--3a17b304-d3a7-4ac0-8112-7cb8b8680bdf",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--6aa169f7-dfc2-4fb7-b4e1-6cca60c70515",
        "indicator--80be61e7-0e1a-4796-8033-f9baf9f657f4",
        "indicator--5a6cfc46-8b9e-4246-b2f0-dc9533f938c3",
        "indicator--f1a09134-0c90-4adf-ae36-d90f86844d2b",
        "indicator--b82020b2-4468-4e2f-92a2-2d2eda3d26f2",
        "indicator--56a34fb7-dcae-401a-8272-997988198477",
        "indicator--8c53a92d-34e5-48da-9e57-14963060326e",
        "indicator--4a2ef42a-661f-48e5-98c0-3f97b842469d",
        "indicator--d9d0b369-fe58-43a4-b76a-04b94a90adbe",
        "indicator--3fad33d7-3e5c-4db7-bd66-c66d63a4f3d3",
        "indicator--d1b927be-16b3-4b87-8969-063429fa63ac",
        "indicator--f8a7854c-e153-4359-ba9f-ca86c10bdf75",
        "indicator--69a4e2e8-e081-448d-b867-ef148fcbbe91",
        "indicator--6c3084ca-fcbb-4961-9288-8829f2f5fbf1",
        "indicator--321681fe-e4a3-43a4-bd7c-c5ecbe3bd191",
        "indicator--51cf2278-250f-4219-afee-6e8ffcf38a61",
        "indicator--18437627-7310-41ec-b497-3a86f6c9a2d0",
        "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
        "indicator--5fa29840-df92-4fff-83fa-af197bd68ba8",
        "indicator--11cd300a-cbe3-4a04-9fb6-1f29606749c8",
        "indicator--e842f894-a7b1-4f0a-9169-f36c3d55bc7f",
        "indicator--3681f207-72f7-46a1-917a-d8eaaa5af221",
        "indicator--dfee5d25-eb1c-48b1-ae32-52d7ef40d537",
        "indicator--c00cacde-7369-4eb8-80c4-1aca3ffd16c8",
        "indicator--20da4fcd-ef81-4d8d-a339-3795049c7d0f",
        "indicator--49ea0dd2-13ca-471e-90c2-c8d3b3e45e06",
        "indicator--2797d98a-c8c9-449a-9f93-822c7b406002",
        "indicator--79b94aa4-f50e-44f1-9731-11aca4d75734",
        "indicator--1fc57926-a57f-42a5-99cc-227b2ffab439",
        "indicator--f998b495-74de-45e4-b86e-50d2577d6b41",
        "indicator--5224ae45-fadc-4b0c-9d54-1fb18ad15206",
        "indicator--add12936-ef07-49cf-94dc-354d41daf7f3",
        "indicator--dbe4897d-326a-4814-a197-d630fa66106e",
        "indicator--cffd1e8c-6b36-4c46-8cb0-efab45b46c2e",
        "indicator--04c8b00c-e18f-4779-ba27-799ecc8bdc86",
        "indicator--8eb4d42a-8a27-4f82-8fae-03696eb251fa",
        "indicator--7a5f813e-1c5f-4bc8-9b5b-674240ae65a4",
        "indicator--5ee767bc-d40c-4b95-99a9-dafc1f73fd00",
        "indicator--c374350b-2780-4e9f-aadb-3d4434c04b44",
        "indicator--3807e598-b30f-4efe-9638-cbaf8f1897c0",
        "indicator--6679b490-fff6-4b30-babd-ed8dff80a61f",
        "indicator--625a2785-435c-4435-ab25-d3b72203a879",
        "indicator--97c841d5-9a19-424f-926f-7fca01106312",
        "indicator--35ae37c6-40cd-4b99-b082-9235ff1def52",
        "indicator--192d0b4e-14e7-421d-a4c7-111aff713dfe",
        "indicator--b245c357-e9e3-4fbe-9701-27dd561d661f",
        "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
        "indicator--f4889665-112c-4ec5-99c3-8d7f26fc5569",
        "indicator--82c6706c-0c54-4538-99ab-bca4d9e48b72",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--8740a66b-62a6-4684-9d32-1d9ea8b78089",
        "indicator--d0313297-a812-4e35-aa3d-a0df086ad0e4",
        "indicator--b778812e-cd2e-4351-b3e5-a010a1fdb624",
        "indicator--5d84dea8-af68-4539-b4f3-cf872538fc5d",
        "indicator--e882458e-b812-4802-bd3d-f847611050c2",
        "indicator--3fe71cd9-9c3d-4433-8fcf-58c247e874b4",
        "indicator--0e60fe17-1ad8-46f8-a110-9aabb2679614",
        "indicator--3762658d-fe30-4c66-b52b-49aec290120e",
        "indicator--b3925b46-bfbe-4a49-a661-3fa3a393bc93",
        "indicator--f2e1c297-7fb5-466c-a994-4ac4ee7178bd",
        "indicator--e4255cdc-bd7d-4c28-bb1d-af4cf127d6ef",
        "indicator--398366fd-2bf1-4b93-aed7-767e22c1d733",
        "indicator--d5fa39fb-5df7-42ea-b6a9-c611c20e4add",
        "indicator--b707912a-a905-41d1-a9b9-1af91330cb3b",
        "indicator--2e2cd62e-3d3b-4c70-a8b0-b08999c30d0a",
        "indicator--536366f5-533f-48e3-9696-da5e6170c275",
        "indicator--a51943f8-ec2d-47a7-96b3-1b53b482c7e2",
        "indicator--676a3852-e0da-4d74-9ea9-12ff94ee9c55",
        "indicator--9e552a55-92cf-439e-b472-4a03af6816ae",
        "indicator--60818349-d469-4c5f-98b2-7465db58f20c",
        "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
        "indicator--9d487fca-d9ee-435d-ace6-f6d3c27ea88e",
        "indicator--68016460-722c-44e2-84b2-a8f2b9844860",
        "indicator--fd6d3eac-e257-4ae3-9eb4-3b38f3e73dbe",
        "indicator--d720fe87-37b8-40bd-a5f0-58f51ef0110d",
        "indicator--d22682ab-4c54-4886-a982-d485e417d88d",
        "indicator--fb927473-9b2e-4e87-9a08-42117e17ef4c",
        "indicator--ed53c496-4111-4db5-bff8-441e36cc7a07",
        "indicator--f8a3ae2b-73d3-4bb6-a9ee-74188536f9b5",
        "indicator--128a59f0-1260-4a91-b7c2-1aea60d1d47d",
        "indicator--97579288-1ce1-433b-b90e-c38bf480d5b9",
        "indicator--e5547781-b301-4744-ba2b-bff80fcdbc0d",
        "indicator--a0773091-7b7b-40b0-bafb-b46485cb1c2a",
        "indicator--928c9e5b-204f-4c5c-a1e2-dabe7a39fcf3",
        "indicator--f0eadbd9-86bb-4d46-b109-26eaa2bc4bbc",
        "indicator--8d0ec880-2442-46cc-9ee6-595f2d1bd7e8",
        "indicator--96b42dd9-66b2-4a94-add4-b9ec1a1ed737",
        "indicator--d0e5662f-3722-4fea-96cd-ca535d52d4fa",
        "indicator--2e12e835-39b1-4686-a03f-c8fde9112b71",
        "indicator--1e323165-2385-478f-a584-433dbf27505a",
        "indicator--927668ca-97c1-4f68-9fd1-bd48a0c214f7",
        "indicator--8155219a-4b72-4875-8525-57dfdd952dad",
        "indicator--89bb1cb3-34d2-4dd3-b76d-72769a36a53b",
        "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
        "indicator--5bfc1902-4780-478f-874f-b35a13c56bdd",
        "indicator--b980e86c-9bf3-4a7a-a9ee-3c69606b674b",
        "indicator--3333c787-4c16-407f-ad76-c67374481c41",
        "indicator--eba01a3a-bd7b-49be-98cb-442ca82c8ea4",
        "indicator--f90dc26b-99b0-4335-9eaa-e6367028646b",
        "indicator--2dbcef77-f556-4c93-92d8-f5278e1ed1b5",
        "indicator--696b9d3f-e721-4210-b0cb-a03ab0aceca1",
        "indicator--bbcea2fd-9029-4973-8968-1f32abec5b6b",
        "indicator--4d2c0a9b-6cfb-4e44-82e1-880ca15ee12c",
        "indicator--72de38f1-167c-4d80-af5f-b0cd4133096f",
        "indicator--de418769-d276-442f-8623-c3a68077477c",
        "indicator--c7a90778-25da-42e1-842c-546a608399dd",
        "indicator--3b41e358-ba7e-4339-bb63-933db3f26417",
        "indicator--4560348a-f2d1-460b-90bf-33336c86eeb6",
        "indicator--f60c76ad-acb3-48b2-832b-24c06387ebe7",
        "indicator--9142b5a8-0fd2-4389-9a5e-6d6ef54ea625",
        "indicator--07ef57cd-0b34-4e81-945c-fd43df8976f4",
        "indicator--1c73006b-b358-4077-81a8-36f02a19333a",
        "indicator--87fa86a2-d9d9-4c1b-9d95-10c197e82d06",
        "indicator--ac58b978-d197-4271-b1f0-5f2bec9a7163",
        "indicator--a0ddbc16-5b85-4254-b6f4-38d6df3bdb93",
        "indicator--2627b319-1fb3-4d17-bd4f-75a1cf039545",
        "indicator--0766fcf0-30ce-4305-8722-676c540b1eb0",
        "indicator--cee589b5-1615-41c9-aa43-bc86cc27c9d6",
        "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
        "indicator--6d4fa4f6-883a-4173-a209-4a9c930b1f6a",
        "indicator--3c85ea9e-757c-4e18-bf3b-c6afa4501e0d",
        "indicator--f422971d-2434-4b7f-bebf-4a46c38aab5f",
        "indicator--6734641a-e230-4d68-9ed8-c10affc84904",
        "indicator--cc667c24-c4c1-4a13-b407-1a01cbbce293",
        "indicator--a15541db-e961-458e-aba1-b348be38c50e",
        "indicator--08b18a8c-0c0e-43cc-908a-0af44eef5355",
        "indicator--ca3fbf8b-84c1-4793-bb21-fbb765f1f972",
        "indicator--6b46e7df-41d5-4edd-9fef-8e05fac84d35",
        "indicator--90670556-e247-4b70-bc5d-7d18025d5446",
        "indicator--eae946a8-97a2-4871-bcb1-58c2641c715b",
        "indicator--e1bb74eb-ae1c-4588-ae4d-d892ba43e36d",
        "indicator--dc6eb686-b43b-452e-9264-fa729961821d",
        "indicator--25c2e7e7-40ee-431d-9ac4-fb8c0ccf2a78",
        "indicator--1ebc9dfb-2a26-4683-b163-5eabf1c28729",
        "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
        "indicator--f386e6e9-7dec-4d81-8f8e-2b3f20b9f4e7",
        "indicator--b414dc59-0a03-4e53-b059-9982b744c326",
        "indicator--82132550-a1ea-4fe6-97e9-c08e5d718ee5",
        "indicator--f28ac2df-959f-43b5-b729-224973b5c1c4",
        "indicator--9c8a88d3-9852-4fba-addf-6dbc74d5d858",
        "indicator--1bde6af3-45a9-4667-8a2f-d61a4baac743",
        "indicator--b075924d-11fc-4b55-9d38-a675622be482",
        "indicator--be17d8ec-4432-43e9-9543-2c1cf045db2a",
        "indicator--dbdb1a72-231b-45f8-b7c4-33ad6993f7ba",
        "indicator--c253af42-2a8c-4c63-82d9-827ad3ae67c9",
        "indicator--4949010d-7b5f-4c3a-80e5-56c2d3f010a8",
        "indicator--3ef755b2-997b-4842-8fca-e2d0190bf9f5",
        "indicator--6cc71d96-c51c-4f37-a14d-bcaa17de9849",
        "indicator--dcc132d6-0ca7-4fb7-89d7-bfb1a7b40991",
        "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
        "indicator--7d42d0ed-8576-4db0-af0a-caeedd8fb512",
        "indicator--bddd1e2e-89a8-4907-a641-b514b397349e",
        "indicator--4f25897d-16f3-4120-a40c-692de0e7ee43",
        "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
        "indicator--14e3e1e6-fa85-484b-b6da-b7719624bec5",
        "indicator--c203c710-2809-443b-b447-ff2550958617",
        "indicator--6a22c6fe-44a9-49ef-9704-9ba5a0806c84",
        "indicator--4fb71f08-cb33-4bfe-b15e-09086e6138de",
        "indicator--14999595-8ebe-49c1-a4db-a10ecf9d804e",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--1aed2b52-edc4-4c40-9776-5b164356ab47",
        "indicator--36a9f66f-318d-40ab-8517-b2d3bfc2e23a",
        "indicator--277aee55-a234-41ba-aeb6-d99a67309183",
        "indicator--870e4053-c17d-4e67-bc68-e1fad57c3da9",
        "indicator--69c0da84-39e0-472f-a358-e98378ae9727",
        "indicator--5b2f0804-a7a8-4612-8646-94904618a463",
        "indicator--d1922af9-a3e3-4b77-b089-0a74477a88c4",
        "indicator--d7a77daa-431a-439a-b365-b6eb7f17aafd",
        "indicator--7354e646-9057-4c56-ab2d-e1ce520da910",
        "indicator--0b02ae80-b0c8-49a2-ad94-02cb66b48fb9",
        "indicator--847635cb-a39c-460e-baf5-85b14bde31a5",
        "indicator--9133bb7a-3fdc-4fd0-be55-d5f9ef46471b",
        "indicator--3410742f-72be-4104-817e-c49886f6107a",
        "indicator--835d8321-4a92-4944-a74b-7ec349bf418b",
        "indicator--59cff2fa-9f35-459d-933b-13eb9d0eccc9",
        "indicator--f8d14e13-2398-4bbd-be63-45ab6235e595",
        "indicator--500816f1-bd04-4dba-9f4d-75c13c2b8d62",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--a6b6e82b-1e25-41b1-ae97-ee23e8ec24d7",
        "indicator--c1d69374-da9f-4a18-b2a8-2de8978760ac",
        "indicator--37b4d82a-8d22-488e-a65f-92d625cb5cfa",
        "indicator--ee69a1de-760c-45f3-bdf2-6b43ffdceb66",
        "indicator--464dcef3-c31b-43b5-8cb9-1c5581357fe6",
        "indicator--8eb2264c-3b5c-424a-bfda-7f81cfecb89f",
        "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
        "indicator--4ec0c3dc-f6e0-497b-b5f9-fd24f30d01e1",
        "indicator--b302d0b8-e9db-4b9d-a6dc-ec2a8e4ce68f",
        "indicator--15faa60c-96e6-4261-8320-79fed57cd28b",
        "indicator--715faa72-56ac-40a5-b3fa-48b4b8c57368",
        "indicator--6dee1c67-5de6-4de9-8be4-378f6a4e1542",
        "indicator--560a30cf-989e-4be9-9d6e-a9bfb775be50",
        "indicator--21e2de84-3313-4faf-b982-c6ce545f28fa",
        "indicator--d9336836-2cae-4d28-b949-616ce88ef746",
        "indicator--4f5f2eb2-22ff-43f8-82c6-ed3c45df5b22",
        "indicator--d7a0a70f-d6bd-4bd2-ab6d-f5ac9bf7c619",
        "indicator--314f9fd8-ef40-4316-b0f2-57b61fa52cbb",
        "indicator--a0c9f9c8-795d-450a-bbc6-63e7c461f588",
        "indicator--6aff7db0-ada6-4b13-82c1-a4cbd087f13a",
        "indicator--2c05c4a3-3e10-4311-8088-721c0fff5404",
        "indicator--7a0006bd-c9e1-42c3-a0f6-a5d677d8b1a9",
        "indicator--0c279790-f831-47fa-932d-25340fcb0c1b",
        "indicator--4542ee94-bbe0-4f6f-96a0-b1f5e3a09d48",
        "indicator--61de1f87-bfc6-4f85-a51a-ff79c8fd7fad",
        "indicator--3d732f2e-2800-41e0-a137-1590a77e4091",
        "indicator--c2a2eef6-c628-49a3-b1e5-a9592345eab2",
        "indicator--4f1b4e64-4315-4cc0-b7b0-a4c48c69c47e",
        "indicator--7717f42a-4a82-4753-9827-3fcf779a8944",
        "indicator--9eb9c37c-a576-49a2-82e0-8c452d30be63",
        "indicator--9e9d79fe-3fa2-4f58-b5f9-90775c35e1fe",
        "indicator--1f34b5cf-a162-4576-b885-abc844c2fbdb",
        "indicator--7fc924b2-45b4-46d7-8cc3-694e428077a5",
        "indicator--7c7abf33-9d98-458c-85c3-2f0c326afcd9",
        "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
        "indicator--01949524-5c85-4882-bcd9-f11ad5eb2b83",
        "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
        "indicator--96fd1c07-3fdb-42d6-9bff-3c501baf11b1",
        "indicator--a906beff-b9db-47e3-9327-141500013b2f",
        "indicator--cfa835ce-812c-442b-afdf-fcffa04c212e",
        "indicator--b147e083-66f3-4b3d-a021-7babab29af87",
        "indicator--ade72f7d-271b-4562-832d-22ff70178e52",
        "indicator--79e41f05-b89c-44d4-ba56-b9e687b09eb8",
        "indicator--8914d111-4ac1-4d0b-a3c0-d5cc50e84bab",
        "indicator--131b91ad-9ca6-4daf-bb4f-0faad70bb263",
        "indicator--5730b215-9326-41d1-8a0b-8eb419d92580",
        "indicator--fec1ce6f-e6fc-4335-ad64-3e80c3da5fd2",
        "indicator--4fee598d-3219-44cf-b7fb-b970980ae157",
        "indicator--9b78cb97-9204-43f6-b635-430089279553",
        "indicator--02cb716d-9f53-4192-89f2-d1dc6eef00f0",
        "indicator--cbdd72fd-4754-4597-9e20-c1e0d0223514",
        "indicator--20fdcd5b-8c3b-4895-8230-00e06d6ba4bb",
        "indicator--a4bcfa92-0d36-44eb-87a5-a7d7ae372273",
        "indicator--ea49e45b-928e-4596-b30d-af99c0f35a39",
        "indicator--4894ce38-4955-4701-82ef-55c6e78d9f5b",
        "indicator--f4800271-ae2a-49e5-b91f-06fcf49c6a0b",
        "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
        "indicator--d81a8565-9202-4f55-8ac8-3f4b40d2702e",
        "indicator--36af7792-e9c4-4a3b-810b-d35bb44d383a",
        "indicator--7a51bd85-2a95-4d35-a22d-6fcd7a79c682",
        "indicator--b2690d8f-69a6-4c83-af07-dd28aa67925e",
        "indicator--92ff04ab-3609-4760-9793-9da9a52fb2e5",
        "indicator--c317f5d7-ab95-4320-a10b-36b4b51e4c16",
        "indicator--37e51044-f71f-475f-91a3-11d5ce816cab",
        "indicator--e8032cb7-eeea-4fd5-bba2-21cc9403d0d4",
        "indicator--e6ed7cf3-abf8-4540-a9d2-7088ad7ecce2",
        "indicator--1605e60d-63e1-4f8b-96d9-0b01cc414e46",
        "indicator--278100d7-42f3-4bf8-b47e-fd9341f39119",
        "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
        "indicator--464ae9ed-cc40-491b-8284-bc8b0a2c2bcb",
        "indicator--4b6ecdb7-d289-4871-ba36-1262b9961285",
        "indicator--eb3347b9-3b27-4ee0-8053-2c9a4dbfb813",
        "indicator--6fb3c7a1-1e5c-43d8-b424-06cdc2669500",
        "indicator--515b620c-42c2-485c-bb7f-13bdfd7ec9df",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
        "indicator--85992268-45ee-4a73-a049-b97ad20101d4",
        "indicator--cf25f12d-806b-4f37-b197-83cdda527300",
        "indicator--255a5255-b062-4ccd-be5b-de7504ecf6d1",
        "indicator--4eaadb8b-0f1e-4df7-88b7-dcfa018e8ad2",
        "indicator--af219a32-2cdc-4738-898e-2c071c8dc024",
        "indicator--90297225-30cf-41de-98f6-f07ac0de4ec5",
        "indicator--4c479bd0-99ab-4787-939c-c27603308da2",
        "indicator--cfddc57c-0ca0-4ca6-8f89-09c8b2ab8f3c",
        "indicator--8df5af37-5eee-4764-add0-544dc9ab1988",
        "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
        "indicator--a5ca3cff-4d90-4d6b-858b-6cf83799b131",
        "indicator--9dccdd5c-6537-43f2-a60c-c530277cd60b",
        "indicator--5bac5300-4b4b-444d-919b-6d2f7a7e1098",
        "indicator--953f0d0e-bcce-45e5-9ac6-5244c658b696",
        "indicator--baa0659c-1658-4faf-9833-d606ad844fd4",
        "indicator--88f0300a-34eb-4e9c-a645-94090fedb9e0",
        "indicator--f0df9278-d605-4a87-be59-567ad0776013",
        "indicator--20568455-d2c3-4806-92c9-9485f7ea7ff9",
        "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
        "indicator--aa4c3198-7298-43c8-b1dc-c4b0cca2d5a4",
        "indicator--a913cd07-de21-458e-b41c-be0740b24906",
        "indicator--7ebc6322-452a-410c-ae99-a6cd506eb5bf",
        "indicator--f6f0e415-b2c6-45e1-928b-50014b696384",
        "indicator--7f0e6170-7096-472c-a352-4b1355709338",
        "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
        "indicator--9326213f-5895-4184-bab1-cc7cbe4ac0c4",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--0170691f-90da-4638-98e5-40f47a33e846",
        "indicator--34364df4-4f7f-4cdf-9dc3-71931343f705",
        "indicator--9ac952f4-9bf2-4b22-a709-97ca9d0b868c",
        "indicator--68c62d3a-5f5f-4480-9258-ee069450fa84",
        "indicator--995982d0-4547-42c0-a5d8-44c27ca58eb2",
        "indicator--6e717009-6896-41fe-aca8-1dceff0ab02f",
        "indicator--0444e682-5311-4995-91b8-9218f315847b",
        "indicator--969eecad-1dcc-4452-8198-6ad8aedbccdf",
        "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
        "indicator--75214ed9-875c-4b71-b307-05d7b1a61e3a",
        "indicator--889361b3-2d4e-4289-a366-069f4c0a5918",
        "indicator--ca263206-f0c5-40dd-ba40-f86009ca4a0a",
        "indicator--86864448-8651-44c5-af32-da55aa8cc31c",
        "indicator--7bdaaf2a-ad82-4be3-8b24-97c07ecbf776",
        "indicator--4f2570ca-9024-4588-9971-fb410942222c",
        "indicator--a538dd26-5d9d-4469-9737-9b2dcd4934aa",
        "indicator--6d9dd2f9-0e07-4e94-9d97-1ba9663792fd",
        "indicator--a80d64a8-7d82-40fc-8594-46ccbc108ba4",
        "indicator--dabb26a4-c668-4593-aabf-a62c2d5c5fe7",
        "indicator--7a4f05af-9d6b-414c-a1c3-1b1253195568",
        "indicator--f20a8ecd-1e0c-43b2-afb1-9907fd6b80c8",
        "indicator--5414692c-cf7f-47d0-a618-fd8ea083439e",
        "indicator--f12e98f8-34cf-4bcf-a160-d92e1a342851",
        "indicator--3568545d-7715-4e59-90c4-e501c4be975c",
        "indicator--2e36aaad-18c6-4abf-a731-9e14a666c652",
        "indicator--929060f2-3392-4a6f-b2d6-e982da1a5e71",
        "indicator--d2fd97f1-bd4d-4e1c-8052-62de0f5cc92e",
        "indicator--d1c87165-4326-400f-89f5-cebf0d3d8628",
        "indicator--3bef5794-190b-453f-b4d6-16a25b28f1e8",
        "indicator--d9e45cb9-e8f4-4cc1-9b9c-920c203e7ea9",
        "indicator--6168a1f4-822e-47c8-bb50-13644d56b26b",
        "indicator--cdc8d0c4-7be2-417e-b9a4-8f133735a2d9",
        "indicator--32de6b81-33e0-4ad6-935e-ea87f5a740da",
        "indicator--a502c5ee-e751-46d6-ac52-714527dd8a11",
        "indicator--d27297d1-54b9-4d02-a075-0f0ede4ae68c",
        "indicator--954cfbf2-a1a1-46f6-825b-8d4e3777627b",
        "indicator--d91cab75-0329-402c-93ab-ac2bf99b39a2",
        "indicator--02df94ea-d4a7-4751-ba8e-d9fe93859b3d",
        "indicator--b8cc6065-c1f6-4ce2-a438-11245e76d756",
        "indicator--644ea726-41b3-4ddb-afa9-120c81d7c42b",
        "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
        "indicator--e61dd399-12d0-4e0c-ac0f-e5b9c9e4380d",
        "indicator--15f20a79-1225-4330-ab36-8ec6b82f24d1",
        "indicator--c88d6bb2-0a01-4350-a764-18d12e52630f",
        "indicator--f886ec11-5e68-4312-9b08-e904371be295",
        "indicator--00fcd0ce-0ebb-46aa-b858-855be5d6df08",
        "indicator--a10b7c45-890a-4d61-9c79-e1bf6c1eac17",
        "indicator--627ebdbe-c861-426a-a7e2-a61156fe5793",
        "indicator--b181a300-9436-4c0f-980d-23f9032f61da",
        "indicator--0baa6b41-401e-47ad-bbe3-2928e7a9d3f7",
        "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
        "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
        "indicator--d39d2809-384a-480c-93c3-482ebff31559",
        "indicator--4d0121f3-73e5-4a07-ba12-faf0f8313983",
        "indicator--3f3f8f8f-4abd-4290-82f7-320f257eb464",
        "indicator--122aa64d-3b70-4eef-9186-e7c720beb7b8",
        "indicator--8f27efd5-1455-44bc-8932-36fd3b38b7d3",
        "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
        "indicator--82141df0-26d2-47ea-8856-f863d5cd980f",
        "indicator--3a5c4bff-63fa-4134-8d3e-0731f1ba8a1e",
        "indicator--f400af7f-72aa-4946-a704-e8443a9a80eb",
        "indicator--707de3ae-33a3-4639-9313-ce120b6815c2",
        "indicator--d4da6fde-3d0b-4975-a625-eacab734b7ce",
        "indicator--ff939cb4-35ad-4719-833b-ea5a048e24c4",
        "indicator--676b5a43-67ce-464d-b368-b0914d21142b",
        "indicator--0e7fc390-53d2-4080-8c1c-ac200b613eb4",
        "indicator--da43b753-cd24-47af-9326-3065eb1c377a",
        "indicator--0273fc5c-8ad8-4350-8978-6022d9252c0e",
        "indicator--a73b983b-00ce-46c7-b735-fae75ae24f3b",
        "indicator--1ed6e900-51c6-40c2-b695-13d86f43f3bc",
        "indicator--c7b21013-b1ae-4fec-a265-c0f47af84a98",
        "indicator--ae768871-1162-41cb-8b53-014c3caefe01",
        "indicator--d1be2d62-4093-4637-828f-dabff3a7fdfc",
        "indicator--15ae6434-1b14-4849-b371-43eebca25326",
        "indicator--d99b5f9a-f339-4271-abd4-600aad94c40b",
        "indicator--613aab0f-7ee2-4a56-9bc4-486f5d90dc1c",
        "indicator--5866bd32-4d63-41e2-b40f-ee9355ab00a2",
        "indicator--0c05723e-93ae-4459-af69-e715a7305629",
        "indicator--3cda96d9-55ee-42f4-b948-33fbc734717a",
        "indicator--eaba8bb6-4583-4c5c-aac6-98e60234311b",
        "indicator--31c20683-c975-4d2b-8387-803b78661891",
        "indicator--6f34328d-9c0a-4798-912a-9f6a4c9a4a69",
        "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
        "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
        "indicator--a911eb18-35eb-45f6-ab54-a02c4a58225e",
        "indicator--9c1f9fb0-5998-4e97-8323-61a801173b59",
        "indicator--565193be-3c56-4842-9489-103313cc04a4",
        "indicator--07d01aee-8e9f-4cf3-a732-2d8abc21466f",
        "indicator--f2b11d00-e20e-4471-90fa-27af0db5cf64",
        "indicator--b71c1d3e-c63b-49a3-968f-eecceb352859",
        "indicator--bc759b4c-891f-4fbb-84a7-a50ef98e989d",
        "indicator--37a9df55-5e14-4c16-8a6e-f538dd931289",
        "indicator--e80c508d-3e25-4c7d-9299-71405aa62560",
        "indicator--218b7482-b059-4b6c-8ccf-93c33577a45d",
        "indicator--e1e1c7b2-ae71-4c67-ab3c-edbf870691b7",
        "indicator--2826e72f-737e-485f-be0a-f8ad382f5358",
        "indicator--bb2868e6-5709-4531-aeb0-2bb514121fdf",
        "indicator--94a17d3a-e1f1-48ae-9b9b-ccd3a781a501",
        "indicator--c369ef7b-4eeb-48ee-ad4f-9145d8165216",
        "indicator--17a0c170-bddb-443a-b417-050952d9e2fe",
        "indicator--5151c88e-fde9-4fc1-8fac-7de6d835fdb1",
        "indicator--189c5b32-8cf9-47ba-94d8-0c84f101bc4f",
        "indicator--9f68e0d0-d947-4150-88e0-a70649467e3b",
        "indicator--ab313e85-db08-4ab8-8ca2-9079542b987b",
        "indicator--b933a317-3678-4f88-9822-2bfa70680431",
        "indicator--2e1e9009-760a-4e8c-83e9-cc2130b712ea",
        "indicator--9aa6efda-8576-4cd0-8f73-ef70241b1303",
        "indicator--9e7ee3e3-34fa-4a15-8339-ad80289d68d8",
        "indicator--c39c9958-639a-4dc3-a403-35f3916d7610",
        "indicator--dcede044-0de9-4d5f-a580-1ae9f9adb0ac",
        "indicator--63ba1474-f56e-485c-a625-44bdd82d6931",
        "indicator--f5eaa587-b392-4838-a933-d19cbbfc4224",
        "indicator--e6690933-fbed-49e6-b660-b50d43f5e750",
        "indicator--ed7d6c1f-fff6-4190-abe6-2a822d684784",
        "indicator--7280e47c-cde8-4282-9d73-d1cc2b719f41",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--fa49535a-6bbb-4a4d-a003-c832edfd8147",
        "indicator--fabddb59-7f02-41f1-a88f-4bdd775deca5",
        "indicator--58b0c80b-6b93-4f6b-addf-f81c774e5d7e",
        "indicator--2cc1843e-e3e9-4f05-8520-793b45330b42",
        "indicator--8747e522-8ec1-46ad-8c84-c3ab4a3e15dc",
        "indicator--c6bb1f16-f944-49d5-b6e2-a02fbe578f43",
        "indicator--051d1c64-f795-4671-a63b-75fe7de8374d",
        "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
        "indicator--efe76f37-1387-4e9b-8ec7-62ebdd0cac4e",
        "indicator--b123ced4-a4a5-414d-8376-481ec094b8d5",
        "indicator--afa5e192-5ef8-47a4-92d9-85ff4e5e8188",
        "indicator--c44a325b-9501-4690-b350-3e498290f4ac",
        "indicator--8b1e72ba-9430-4828-b0ee-5c4a3ccb7171",
        "indicator--6198f645-4b34-4417-80c1-c8aecef5816e",
        "indicator--1023278a-ef41-4fcd-852f-c105b6ad92f1",
        "indicator--75acf94d-2222-48ce-8fb9-0f5c879d2af4",
        "indicator--50ba8a45-005f-4320-b733-8c6adc32ab5e",
        "indicator--3f65e120-8a56-4310-8b2b-afde534359a3",
        "indicator--8a0366af-075f-46e3-8b11-c16b969d7072",
        "indicator--d99608f3-27a8-42e5-8372-75cec2e5f000",
        "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
        "indicator--f43d983c-95b0-4960-a5de-0623ef0edbc9",
        "indicator--37ec54ca-cc59-4363-ae34-f94298c0fa33",
        "indicator--b92b8d07-6c7c-4fb1-af1e-d2a85472f0f4",
        "indicator--25a60497-5d49-40c5-8277-a68b452af4b2",
        "indicator--d2895375-4d0e-4649-87ee-f11454d6932b",
        "indicator--9ed718cb-fb30-4669-a5d7-08f0a2273453",
        "indicator--d3c063e3-c79b-426b-b30d-60a00d75f600",
        "indicator--73aa9c21-9399-4d8e-afb4-9b4ed1c67d6c",
        "indicator--0e7eca59-6109-4da4-a077-197430a682e7",
        "indicator--e955d923-219b-45ea-bd7b-49302da87d13",
        "indicator--e0cb8a6b-c1c2-468e-89d0-1adc44d2b610",
        "indicator--f69de0ca-7778-462e-8325-83f5749737f4",
        "indicator--b39373ed-6ca4-4f14-b86c-ddbf47c81fd3",
        "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
        "indicator--57884685-6ead-4bde-a54e-0dee4f43b86c",
        "indicator--bf4a0516-e166-4234-a6ed-f97a0ea67b57",
        "indicator--e54713d8-7078-4cc1-973b-8e94f651a360",
        "indicator--679c12bc-a122-43c4-8a61-852b50b59807",
        "indicator--7fcdd2d0-bdea-4e53-b90a-479dd85a6291",
        "indicator--3b439ae6-3cba-4bf5-baf9-58d9cf3ba43f",
        "indicator--708d24ce-b8dd-4dcd-b2ea-4bdb59acc96b",
        "indicator--070186f1-1bd0-437d-8010-85dafb1fab0c",
        "indicator--d5b1f15c-7eef-43e4-b006-bfde6eef621c",
        "indicator--887e7f19-1b90-455a-8cf8-5891f4ec39b6",
        "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
        "indicator--159ab205-c168-4fec-9aa2-7e6eae7f81e8",
        "indicator--3fd44e11-6bab-4835-a15e-ca53f7623448",
        "indicator--528d057f-7ec1-4bfb-bc36-77d5949ca368",
        "indicator--3c2b1815-ae35-4481-a156-44354210ea0a",
        "indicator--4ea1e490-a64b-460a-b6a9-607563219a71",
        "indicator--f4fa449e-2e99-4830-9d54-89e49b9dc462",
        "indicator--0e5125a2-fb77-45bd-b5c3-f14ee16322c7",
        "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
        "indicator--9e9f6fc5-d9e7-4c05-9f26-2fa4e562acb8",
        "indicator--f8ccc893-d8c0-4d50-8d52-128a4d275695",
        "indicator--7ab813af-ac62-4999-91dd-0be4c4685026",
        "indicator--37ed7123-4f85-480b-8cd5-65f6257d5e22",
        "indicator--1c904a88-fd0c-4664-93c3-883cc82bf73e",
        "indicator--ccae48bd-7d6d-4856-9e02-bf959fe64566",
        "indicator--d027aac0-c30c-402b-92e1-b55bd22a4d5a",
        "indicator--c597f52d-272e-4ff3-b1c4-68f26ac007b2",
        "indicator--d4a93990-09ed-4773-b86a-c5d854057f01",
        "indicator--69d18b56-f895-40c7-8cc4-fd99f5c660f2",
        "indicator--092eaacf-ea8a-40e3-91fa-3ea31833a6fb",
        "indicator--3d4ba998-604e-4e4e-9b26-d3fb0b7bae0a",
        "indicator--4f48815d-3e67-406f-98d6-5ac48db3338e",
        "indicator--e5fa206d-2c01-4618-b248-26319263c392",
        "indicator--6902a184-062a-4bd5-8709-a46ef9b4fa0b",
        "indicator--0e023db2-402a-4ee3-9387-e6fa63dfa56f",
        "indicator--6e896a03-1b33-4180-8bf8-42297b565d99",
        "indicator--5abda58d-b8a6-44f1-87c3-480d157957e0",
        "indicator--270e42e9-5546-4d64-b527-2f338b734d1c",
        "indicator--81546474-836e-4c4a-afd3-799f7b49b96b",
        "indicator--66e3c1c3-b1aa-4f93-b440-b215ea23d7dc",
        "indicator--ca37e72f-f931-4740-a2cc-764555119909",
        "indicator--6fb9bae3-baee-4496-b6f4-00678b6bf2d1",
        "indicator--7ff1a1a3-7857-439c-ace8-08a280d610f7",
        "indicator--2eb7534f-3361-440b-af44-48157a5021db",
        "indicator--47ae71a6-bb97-460d-9340-9c7b67722793",
        "indicator--96349934-5da5-42a8-bb60-7d183f9dc247",
        "indicator--f4e1e380-a605-4743-bf4b-4d833a460ea5",
        "indicator--bc19a7bc-f122-4472-b77d-a94fe6921f51",
        "indicator--3c425c4f-485d-4525-8dbb-3251a6d48a68",
        "indicator--92b4bb19-b945-4a65-9619-1eeb7d375656",
        "indicator--5824576a-3d03-4431-8105-37c21240aa28",
        "indicator--a2b177eb-918a-4f7e-b6a4-8b3e0dfc7340",
        "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
        "indicator--9c37c9fe-39ab-4f1a-921f-1b0231d7db5a",
        "indicator--00704f3a-ed74-40d2-92d6-77dd4d97d8cc",
        "indicator--aced7148-afa3-48b0-942d-8b615684eaa0",
        "indicator--2bc7bcbd-e395-4b8f-a3ac-400c64dd20ae",
        "indicator--d1c3cf45-04fd-49bc-9fc7-11ebdb17e8cc",
        "indicator--717f603a-e198-4453-b528-eceb869a4380",
        "indicator--956db0a6-f276-4f3d-84d4-1cfb276ced65",
        "indicator--348399ed-7bb7-421e-b2fb-f2f513e46593",
        "indicator--0eee4e89-72b8-4ba6-ac4e-2794cc3e4913",
        "indicator--be348985-8f5f-4c37-b6b7-6acc0ac69be7",
        "indicator--a1645d24-8fba-44c5-bbab-92942db11f5e",
        "indicator--65bfbfac-5c65-4d86-9734-8e08efaf3c4a",
        "indicator--6c4568a9-e1f0-4920-8f89-61889c3824a2",
        "indicator--e4087f08-ead8-4634-8435-c48ff97e01fb",
        "indicator--b3d67efc-68cd-45f5-be85-f35b973f654f",
        "indicator--a41bbea1-beb2-402d-9aff-a3a2b0a0c8fc",
        "indicator--21827904-c1e5-4244-be73-7eac00ada749",
        "indicator--140d8ae3-2b88-4b71-ac30-545f06c50d02",
        "indicator--8cbf4a59-3e99-425b-884b-cda79877ef94",
        "indicator--92dfbf58-ae2c-46e7-93ef-5015cc82e8c2",
        "indicator--0533c882-45cf-4f37-ba30-5c1c298762c5",
        "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
        "indicator--219ccc9b-c531-4d02-a110-f67966eefc38",
        "indicator--e62c6e2d-7223-48d6-a928-7c486024e9c8",
        "indicator--260c2ca0-0dfd-4761-be75-0b305b8c648b",
        "indicator--a348fbce-101c-47ca-87b3-eb410343c49c",
        "indicator--783bc55b-bcca-43f8-8c70-6c3606760b30",
        "indicator--8b03218b-4276-4712-ad4c-f69d1420af08",
        "indicator--eab00c1a-e750-446e-9aef-8e8c940399e0",
        "indicator--3c59f11a-590e-4cc8-b6f3-77bc21b59f03",
        "indicator--6d96b222-8c8e-42f7-8282-3a74281fc1b0",
        "indicator--8c0de635-6e93-4b3a-8ef9-9b6e3d8493b7",
        "indicator--31fa763d-3c61-412b-841d-94b183d5f2e4",
        "indicator--1277904d-69f6-4a5f-84f3-1955c5f8c304",
        "indicator--a84bbaa7-5eab-482c-93bf-3f29a04b5e51",
        "indicator--8f9aa383-30d4-4ab1-b807-f82bd658b5d3",
        "indicator--2747540d-f196-4193-bb9a-9aa69a12193a",
        "indicator--9a6a9cc1-c44f-47b8-ba48-023e6251cc34",
        "indicator--4ced30c9-a14f-486a-bc04-040b94a221ae",
        "indicator--1a0dfa43-c42d-40b2-acf3-8a833e51a637",
        "indicator--2ce4e4c5-56b6-4e4c-b569-47f21ba7c2de",
        "indicator--4f84af73-293a-4043-88f9-591b43192ec1",
        "indicator--648ddfbe-e17e-4777-a05a-1374b737d81f",
        "indicator--eadd0f2a-c1f4-4435-9239-0d537978a3bb",
        "indicator--74791781-df24-4f59-ad1d-e99147e134bd",
        "indicator--077323e7-5759-4285-8a63-ecd656757cce",
        "indicator--8f6cb2eb-dcc9-4e11-8ad8-ceab7b9b8c59",
        "indicator--457051d2-ca3d-41ec-a10f-355e43e4c494",
        "indicator--f89e3ac8-722b-4c93-b904-6e259c7c311b",
        "indicator--50087337-eaa3-42d0-9bf6-9192647cd34b",
        "indicator--6c7e8ee3-5aab-42f8-92c9-ce1b8185aa91",
        "indicator--52f3c77b-89d4-45ae-9f1e-a36d86ed38f9",
        "indicator--e14a6228-31f7-4322-a59c-c8a643372ad6",
        "indicator--d5f99602-426a-4500-9427-858aba516313",
        "indicator--e562fe8d-b1e0-4f0a-92dc-6955a16d0440",
        "indicator--120b24e9-f5c9-403f-afb1-fcee1cba38cd",
        "indicator--ab7fa4b5-a68d-4502-8f6a-2624f50d93b5",
        "indicator--9a992da8-0669-40c0-9ada-304d14552518",
        "indicator--2c020061-1f57-4d82-a07b-ef1254398c54",
        "indicator--9555aff0-a1f2-42d5-a54e-08b4367b0cbc",
        "indicator--02df31db-5567-4f37-a222-1261494e8621",
        "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
        "indicator--fbbcf38d-2716-4a22-915d-fc9371241a25",
        "indicator--2a1b6318-1d31-4355-8d12-1959b9c51f79",
        "indicator--0eab7689-b380-4679-a991-4437870f644c",
        "indicator--02a8fe59-3603-4bbd-b0c0-a78d6fe1d0b9",
        "indicator--c3f7b6d1-c1a8-4b68-a59e-9419e9b1193d",
        "indicator--51e9c7db-7b4b-45b0-bb82-6b09c5a8a6d4",
        "indicator--a175f207-4ce8-4ffe-99f0-b3c18cfb44fa",
        "indicator--b043dc2d-7b96-4698-8841-bf7fc39af5ae",
        "indicator--7ea63083-fe67-4f80-9372-6a0f6fb74dcf",
        "indicator--9c7b833b-612d-4a6c-86bc-0392226b3c76",
        "indicator--c17d455c-e783-47a0-a9ea-916c897dcede",
        "indicator--7b47f93b-0719-4654-a984-a926d6437033",
        "indicator--6ee978c9-b3da-4131-a807-a31bba0889da",
        "indicator--f2492d10-f95b-4e71-8af7-4f057286732f",
        "indicator--0b1c7f20-1490-467b-9090-da62c8b3cc1d",
        "indicator--1bdd7694-8352-4a0a-8cd9-57ff37a2bfc6",
        "indicator--a8d310de-ac61-42e8-9c44-07aa6b47bd48",
        "indicator--32f304d5-368d-4f32-9b2a-721da46ecbc7",
        "indicator--d0bbc1ca-e811-4960-aab5-328da4e32b16",
        "indicator--0dbfa8a5-e1af-4350-bdd3-c8501f05e550",
        "indicator--45f44d82-d487-4029-abc4-b58706e756a5",
        "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
        "indicator--54d7c922-5a31-4553-b45b-dedd022b2951",
        "indicator--fcffa55b-f9fc-4d0e-af0c-2b1b703dbc09",
        "indicator--cff5c1ae-3e41-4c55-8b9e-b98064ba1693",
        "indicator--c4ad5430-c997-4d8b-8172-8129928db964",
        "indicator--dbd4710a-d63c-4644-92a0-f5a476c7a72f",
        "indicator--6436093f-d34c-4c7c-849d-d9f75663082c",
        "indicator--e8354c42-7f6e-4a89-9219-ddcaaeb477d5",
        "indicator--579a38f8-4c10-4aa6-af2b-5b2c95f0cc23",
        "indicator--ecd39e37-abb6-4d68-8a69-15e8bae892ee",
        "indicator--831e6df6-af06-4be7-96d0-dc35a97b38b5",
        "indicator--afe508a7-2941-4c21-9501-1ea6be104d27",
        "indicator--795f6593-6707-42bb-b25a-e28550491a9d",
        "indicator--2d6bc56f-87b9-40aa-8e01-05edb1fd8f14",
        "indicator--307765cd-e254-4b07-91ff-bf988a1fbecc",
        "indicator--d82b46b9-58df-4bac-b101-393ea305b123",
        "indicator--5b5135dd-b157-4256-8d85-f86845086cd5",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--f036ad83-09a4-40ca-a8e3-3b8dffdfb876",
        "indicator--c25b12d8-f988-42b6-9a86-ea5ead6e3fc7",
        "indicator--cbe5aedd-a613-4d68-abbd-3f16baa0afb0",
        "indicator--4acfb911-9d05-43db-8afe-c46e5552fb26",
        "indicator--250fa092-1759-4898-aafc-9e5923cb7501",
        "indicator--366d130a-9062-47e9-82c4-e07033db1eed",
        "indicator--c5c219aa-bc60-4990-97fb-0aaef71690fe",
        "indicator--b7cb652f-9df2-4343-a015-dd39d27e9c9b",
        "indicator--a42c74fe-4319-4b9e-9b77-07e0ae983445",
        "indicator--b97d6d8c-02eb-4032-bc2d-54adfc6e4abe",
        "indicator--f3ad7088-c6ee-42ad-8e41-ad9acad7f0f3",
        "indicator--14f7bd7f-002d-4e1a-862e-526ebaa09b74",
        "indicator--85334f1d-eab5-4f0f-821f-db6cc43beef4",
        "indicator--11f05cc4-6d9a-40f3-992e-9135513c0007",
        "indicator--389e034f-34d7-417d-a484-cfb0bd51fa8c",
        "indicator--3d5fd64c-9b68-4889-8389-5e0527b62689",
        "indicator--8f4c484c-e649-4cda-b113-9a3dc8ca8998",
        "indicator--8f2fd020-43b9-4482-a72a-2ac184317c9c",
        "indicator--5ea437c2-2406-4a9f-ad6d-a81d0d421475",
        "indicator--0896d7a9-ae51-4279-9ae1-934da0307893",
        "indicator--29c176ba-2e4f-443f-9520-9c020919f0df",
        "indicator--c8eaebb6-f042-4c3c-811f-e6eaa5357b4f",
        "indicator--e437bed7-8d1b-409f-b3c9-4c2246b04e1a",
        "indicator--21a0ab9e-0d3b-4d75-af61-eeca72fabf4c",
        "indicator--c247b911-9856-4ed9-9c4a-7675861a2a76",
        "indicator--7ffb8877-2da0-4d8c-8acc-b476a34d6d4f",
        "indicator--0e96650b-2401-4213-8150-c7a865d63401",
        "indicator--71df28b9-7198-4873-9323-82b5423ec959",
        "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
        "indicator--49696639-276e-44dd-ba45-b24616a9d591",
        "indicator--8ca51219-28e3-4462-9148-f412342669f7",
        "indicator--3bfd7de0-1d83-4d63-b02e-1d33ad651649",
        "indicator--8a06f8d5-970c-4357-986f-549c4cd5242b",
        "indicator--ba4d4eb8-ddb1-4297-b141-1b18c886e0f9",
        "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
        "indicator--8e4c1f4b-1396-4faf-b540-4eb45fe302c8",
        "indicator--bc5f504c-464b-459a-871c-cbc6b7e1a2bb",
        "indicator--85d8e66d-fae4-4133-9f15-df67668cce39",
        "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
        "indicator--f0d1a70e-b01d-469b-b532-2e0a9ae5081d",
        "indicator--b20a0f06-febe-4f02-837a-605c72b3189b",
        "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
        "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
        "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
        "indicator--8f5e312c-01e8-4432-84fe-433584f5c1be",
        "indicator--7f3e8252-9788-4b7f-ae39-27680ce0b349",
        "indicator--58dde9cd-fc0d-417a-96aa-c7d716ecea70",
        "indicator--a0cd1a2a-201c-465d-93f9-6d72218ca699",
        "indicator--519ae41d-70e7-4d29-bb4f-4754153a9ef9",
        "indicator--8812df52-8d69-4973-ad40-f988b7833ad3",
        "indicator--b4c4f89d-a7f1-46f9-a269-ad28868f981c",
        "indicator--c9b1cd4a-36e9-4baa-824a-d85d5c548569",
        "indicator--aacdff97-bd53-4bd8-96a3-ff2d8f272549",
        "indicator--bdd126a6-2d7e-4ad2-8f84-b0e86e01b8d0",
        "indicator--4df96763-9d8a-4c62-ad28-d9aa12669574",
        "indicator--b7352c1e-a161-49a7-89da-f64640b3fc76",
        "indicator--3805cfb7-38b3-4386-b65d-d94d2fb6d227",
        "indicator--208a7399-f71d-43bb-bf8c-1075a9ab9bf2",
        "indicator--eb7e2200-4d65-4e21-a640-ad5645e82e46",
        "indicator--ad9f26cc-22e3-478c-b189-9c21313f3045",
        "indicator--5b796c42-2cca-4a50-b6cd-7bf352fbe9c0",
        "indicator--bf31c6fe-6f60-4de4-b970-2bd65e0cb906",
        "indicator--06b7348b-da36-4de2-851e-194377c78329",
        "indicator--b0835c56-efa1-474a-b106-583d1e078fb1",
        "indicator--e1d4aabb-4447-4587-bce8-8bb8df75ddec",
        "indicator--752dcb4a-d076-4753-a3bd-5c6447a8c056",
        "indicator--517df3ae-97a7-43ef-a89c-1ffb9d2ac160",
        "indicator--178aa0ac-7c49-4033-97fa-ebc5113bc407",
        "indicator--4e861962-a64a-4c4c-b285-0ecc9b9a0e89",
        "indicator--2324b3c5-fc8f-40ee-b60b-6ea897d3a4cb",
        "indicator--7691a72b-f209-4b76-bdd6-a6caec8f6404",
        "indicator--3a1a6601-e68c-4f19-9611-d73319ddd678",
        "indicator--6686bd56-1670-4571-92e4-e82f5bc00731",
        "indicator--a5a8a12e-6a83-48b4-b17a-3bb28e99882a",
        "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
        "indicator--192477f9-56e9-4e8b-a2c1-f79a4cec0730",
        "indicator--a4756777-27e1-4f37-af51-8470c3aeffb2",
        "indicator--4c5c7fab-5894-4467-9a9f-ad0c3c094e9f",
        "indicator--ec6582f9-2d51-49cc-8f55-0a43408098bf",
        "indicator--f721b622-2ef5-4c0f-b9a3-239f7cfb2f97",
        "indicator--609797dd-219f-4ec9-9296-d6efadeb33b4",
        "indicator--3ee68dba-3f34-4c02-a830-e942c0779118",
        "indicator--2220da4d-9528-43df-ae9a-11a675e59f6a",
        "indicator--d78b36ef-0375-4f30-94c0-d6b82d59e4c0",
        "indicator--edc05f00-7ea1-4146-955c-1d93f65eb68a",
        "indicator--cdeb1449-bd38-479f-b813-bf264641be84",
        "indicator--c235c3cf-2cb8-431f-87cd-787f436058cd",
        "indicator--6880f52c-b8fb-4522-bd58-187c4339867c",
        "indicator--ec183068-f207-493b-8f11-fd9608f1c7c8",
        "indicator--4461340d-f036-4389-a067-494220c9b66d",
        "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
        "indicator--53842547-9ea3-4b97-b6d4-e585ec83223e",
        "indicator--00a7c61d-26a1-4417-8356-04ce7fea6b54",
        "indicator--8a60c344-cb81-4b7b-89e5-e12cf285c233",
        "indicator--8e686bc1-85c9-4f8c-90f4-81d8173dba33",
        "indicator--d4161cba-12f6-4923-b255-d2aa78815d24",
        "indicator--b9c89d34-051d-4b3a-8986-5a260e793b90",
        "indicator--668f4567-549e-4d9f-84b4-1945da63ab31",
        "indicator--de781a0e-6974-4061-a26d-0739e4c3ca07",
        "indicator--fa2d206e-ea48-48da-aaee-9ffb6e2cd6b3",
        "indicator--90e9b4d8-94b5-4fe4-a2ab-614b2b7a2f1b",
        "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
        "indicator--609281d0-12b3-46df-a80a-1d40a8680dc1",
        "indicator--653a046c-050d-4855-b05c-5e7f8fdb5282",
        "indicator--e288c731-08e2-4574-bf46-7c93442a2911",
        "indicator--419bbc9b-d6cf-4594-88e2-cfbb1f710c90",
        "indicator--64fd27c1-ca58-4115-bd40-d6d076fc7af5",
        "indicator--eb7a0a44-7a78-4f2e-bf0e-7423cc7c8024",
        "indicator--482e0e0c-2680-4b8b-acb1-660caab39769",
        "indicator--53f4f1dc-664c-4e87-958b-7ce75aaaa51b",
        "indicator--abf68990-e42c-4f23-83a4-b8c8e8504797",
        "indicator--baea6f51-f88f-419f-a305-fbe1bfde1330",
        "indicator--53f9a07b-dba2-4595-963a-22c1b8db0e24",
        "indicator--f0f0b8cd-1a2a-426e-ba61-78442d5370b0",
        "indicator--573e4185-79ac-4afa-9b37-a85f13825d70",
        "indicator--0d185215-3ea0-49bd-9327-bd10ac59ce9a",
        "indicator--513f9437-af24-44a7-a944-a41905ef9bff",
        "indicator--65eeb4e6-fdc0-4175-a9a5-6f9decc4e983",
        "indicator--1badad10-6d46-43b9-8cc9-c6054907ff25",
        "indicator--6acc45b0-e13a-4f57-87f0-975d5fba3f58",
        "indicator--b8680ecc-154e-45b0-87bc-24fdd8f97787",
        "indicator--acf504b0-fcf0-48e1-ab66-c3b7a4913818",
        "indicator--37a22b7f-8cae-46b5-a8ba-bcd28f9790d2",
        "indicator--aec82b0e-19cb-4743-a9a4-0e791d9eed6d",
        "indicator--3403d14d-9599-4bcc-be63-a26dd910b102",
        "indicator--c7b76a4a-af80-4a7e-9f61-0b8361cc4cd3",
        "indicator--9fe40dc0-1eef-40ba-b4cf-e7737cadc621",
        "indicator--04274522-5976-4e2f-b515-50abad22e929",
        "indicator--521fa0a4-8f19-440b-9059-6421608caff3",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--5593d710-3abf-40d1-b5b0-227568c08c84",
        "indicator--a5e9f139-3bec-4a39-987d-b182bd81267b",
        "indicator--6075b5ca-762d-40ac-b862-3045d87e08c1",
        "indicator--ecf59402-8517-42b4-abfc-5e30461146bd",
        "indicator--ae491f81-156f-4781-b853-30096dc5480f",
        "indicator--2fd18e5d-7c1e-4993-b194-a9240630572a",
        "indicator--aba167b4-91c3-4fa6-9a8e-37b6dc7052c5",
        "indicator--915922ba-7102-42ce-a8ed-96f6537b8d99",
        "indicator--a0b89dd7-8a53-46dd-9424-b725a56056ea",
        "indicator--dd82b350-54c8-4e9e-bdc8-0d74b9e5f395",
        "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
        "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
        "indicator--c0d4d02a-e901-4aef-89df-965cba3dd6ee",
        "indicator--2691aed2-bbfd-4fce-9523-a61484baaf41",
        "indicator--8c8ea0c5-fd93-4f9d-abcd-a5e5720de004",
        "indicator--02a47589-de81-44ab-b0a9-e4a54fe5300d",
        "indicator--5e37acd3-f0f6-4092-848f-21e216f930db",
        "indicator--187133f8-2f27-40b1-a3af-6d5beb279878",
        "indicator--d2cee9ad-1e91-4b55-899e-4ab69e4adfc8",
        "indicator--0e81553e-613d-406c-9a7e-2812cef1e099",
        "indicator--5eb056b5-c043-441c-978c-caf66435114b",
        "indicator--67382000-d044-4eb5-9802-83d822f42e88",
        "indicator--46b1f428-3572-4f51-beca-dbbd8ab64127",
        "indicator--b7265c66-e586-45da-b835-0e745b19b887",
        "indicator--41dc28bc-4f3e-4f07-beb8-75858e626551",
        "indicator--c240c563-5972-4600-933e-dceb4ed21cd7",
        "indicator--e76bce48-e854-4cf7-9ef8-efc18c380eaa",
        "indicator--d5ce3b57-1844-451f-aadf-011a626bc9a7",
        "indicator--5149d05a-ad63-43a3-a7b8-6c15b4168299",
        "indicator--ae7d13c3-c4b9-431e-a3a1-74f503ecf5e8",
        "indicator--bbf55538-edf1-46de-9680-0f8b996016d4",
        "indicator--d3cb8edf-5888-418a-93a1-30f1d01900c9",
        "indicator--2ab5b830-6156-4df5-9d44-e43334e12b52",
        "indicator--a1c14fed-f736-4b06-a96f-6baf04373f80",
        "indicator--f4b9d443-8238-4f8a-bb24-9bdd9cd08188",
        "indicator--a76720d1-1d1e-4f74-9b0c-06178247c426",
        "indicator--27dc80f1-d2a9-48ae-87f5-bdeba2b3e788",
        "indicator--20db95c3-2d2d-4212-902b-9b04d7860e0b",
        "indicator--e3e20926-84fc-405a-a459-30f2b62fdac7",
        "indicator--a34e329e-0cc0-4ea1-a36c-8b6c520acd04",
        "indicator--51aa2c80-a12a-492f-8750-9fce0d773945",
        "indicator--6df485d9-c5a1-4a6d-ac49-93c2b1dcd892",
        "indicator--0cab0230-dde0-4abf-ba2c-d725a3666d0d",
        "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
        "indicator--6b54d3b1-b4e0-444d-bb67-a187bd3c7a2d",
        "indicator--dfb813bc-cf93-4abe-9c09-4ab7ef48a745",
        "indicator--28b7e96c-17cd-40c0-a6f2-fa66abe74b42",
        "indicator--f0565d92-a029-4eeb-869c-192a001b8c1d",
        "indicator--4a595fa3-936f-4a1e-b47d-cec4a6cc8aae",
        "indicator--b5b3066a-2ea0-4df0-85fb-e4a7673d8b9e",
        "indicator--b0e5e52d-d856-4205-881d-4693dbfbff2f",
        "indicator--4869d02f-29b1-4c00-b013-bbbafb48b9d1",
        "indicator--d3dd15f5-7b12-41c3-916f-aa299618a167",
        "indicator--b2c2508b-ba70-439d-8076-ebe21fd240e6",
        "indicator--3fc98896-5f41-4df8-8b24-638b4b3f5886",
        "indicator--18fb7827-a384-4921-9682-486996033fe4",
        "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
        "indicator--04fea1e9-03de-4f8a-b35c-85e0903a7296",
        "indicator--45074f51-34b6-48e9-bdc8-ed5103a2bb54",
        "indicator--8045e78e-ec12-43cb-9d39-3c318d36caa3",
        "indicator--ea3b917c-8dcb-4cd1-9ff3-619bc3dbd406",
        "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
        "indicator--f272a864-2c0c-444b-99f0-5aa65fb85e30",
        "indicator--be65d27e-8e1a-47a1-96e7-606d03b1b3a7",
        "indicator--3455fa6c-1259-422a-9ba7-8e91a72f28cc",
        "indicator--198448a1-c2d4-4e79-a096-39dae5a4d4e7",
        "indicator--0464ef7d-cacf-4e99-a1da-8340fb41171d",
        "indicator--6af2a42a-a113-4e2e-84ba-de2719c59bec",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--6a78b2b8-efef-4baa-a845-cb5983d8b44e",
        "indicator--4383c1b1-9aeb-405d-aa4f-030bf2e77fac",
        "indicator--1f783f67-9d86-484f-b168-2e0b4b8e4517",
        "indicator--760c1f4e-aaff-4f63-af30-114228d06dca",
        "indicator--69756adf-e5e0-44f3-8018-1fdb3eebb250",
        "indicator--7f3c245c-d6ed-4e44-9bbe-dbf192970002",
        "indicator--d27bb77c-c588-4735-aaa2-1ec55520bdb8",
        "indicator--acdca02b-55f2-4edc-adce-45e7686e04bd",
        "indicator--5616acd8-92f6-45a0-851a-767ce0b3b220",
        "indicator--0fb22b21-223c-4447-8938-4f5f4d0dab0f",
        "indicator--7d0ca0ed-38fb-4581-aa75-dffb21057ed8",
        "indicator--8e376ab3-9858-4094-aeea-721f7a0f56f3",
        "indicator--30d52800-416b-45e0-9e79-2010272a6a11",
        "indicator--0cb3c40d-c384-40f4-913a-f1b9f4623757",
        "indicator--6a428de7-58d2-401c-818c-7e1e58c13555",
        "indicator--0e920864-b835-49bf-990c-87d494898d3b",
        "indicator--4ad20639-13ec-4749-9f9a-250fa28611fc",
        "indicator--4cfffaa5-4a4b-4308-afa8-9f63d434b7e7",
        "indicator--2959e089-392a-454f-93af-bd1028176eff",
        "indicator--8778c30b-79e8-4717-b8c8-41c64f3558d2",
        "indicator--4b0dfdb3-6e37-4cc4-b3bc-1ed70dfc4874",
        "indicator--776807b6-aac6-44ee-a6a1-34c69d3ed8b2",
        "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
        "indicator--73803fb3-23d4-4dad-a609-e0a1c031aec7",
        "indicator--f35ded71-42c1-4adf-a9ce-fb43c0be8c6f",
        "indicator--0af70e01-b562-4e23-804d-b9a43cbaa26b",
        "indicator--ef0c1e4c-0c86-459b-9fba-9b16471c50c8",
        "indicator--4919af2d-33a7-4dbb-8610-c884757f14b8",
        "indicator--652eb7a9-3152-4525-b192-0aaea9eb4e38",
        "indicator--62160e0e-6c19-45c6-828c-76c285e754bf",
        "indicator--d73b3770-92d4-4005-ae2c-e11255a0944e",
        "indicator--9a37117e-1c59-4731-89ae-40803b187201",
        "indicator--d0b5fd85-2e89-4ced-bfe6-a9c06d02eaf8",
        "indicator--38c5e946-7f25-472c-858b-2f6128e33f60",
        "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
        "indicator--362d7368-5dc1-407e-8853-dc4e114b9ed1",
        "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
        "indicator--6fea38f2-48e1-4765-a27a-2d87e887fd9e",
        "indicator--68cc3cac-c6d8-4c03-9c34-e839fae75290",
        "indicator--a5e4fbd0-e2e1-4256-8f70-c4b2cfaed1a1",
        "indicator--b12b4bf8-1c06-48fd-83bf-a753ee174704",
        "indicator--ad5a47aa-785d-4b66-92be-62925acdc919",
        "indicator--25dfed67-e2d7-4bf4-a844-28deaaa5fe98",
        "indicator--4c4dcae5-58fc-405f-aca1-cd2987f32d7b",
        "indicator--598ef818-d11f-407f-93bd-9543b4abc277",
        "indicator--bee020cd-fe0d-4e5b-87ac-6dfc34ac5804",
        "indicator--a996d7cf-2965-47d0-86e5-6340b1e8345f",
        "indicator--39958a10-cc28-439f-9862-be38d0c6c325",
        "indicator--4ad24fb0-c143-47d1-9106-25188217aae8",
        "indicator--ecaa2c81-43bc-4f4c-80ab-7a23a54aa417",
        "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
        "indicator--edea3907-6a40-46eb-82a8-44d1be477532",
        "indicator--91c0e70e-4959-4f38-adbe-0fc40746e259",
        "indicator--2b9b3316-2ede-4e81-95df-4e8a0dcd3d2f",
        "indicator--0b9888f4-1029-4b52-9cdb-6af4ea40735e",
        "indicator--e0d5ede3-d3d6-4aaa-ad8c-5b82365fe83b",
        "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
        "indicator--09ec4db5-2654-4f02-b671-449d8fa99039",
        "indicator--e169f209-d2ce-4143-ae31-e1d5110921a5",
        "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
        "indicator--2a3541d7-8f61-4fa7-9fd7-72a3d61b5db6",
        "indicator--880d2242-f994-4de0-b761-76eea6654309",
        "indicator--bb33ef84-f8ef-4198-83e0-f197e442e529",
        "indicator--b4f3f2a6-56dd-46ac-ba2b-e4793612c1de",
        "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
        "indicator--9e455ada-bbf4-4a54-a53b-658b24e8cf91",
        "indicator--13ad029e-179b-4150-b1c3-9bdaf844f78d",
        "indicator--60ebc9a9-d465-411d-b82e-1ca917c16aba",
        "indicator--fcd051c9-5ff7-402c-8335-50615967063d",
        "indicator--b754aaea-04a7-45f5-a807-297127266265",
        "indicator--3ae42fd2-21bf-4d0b-af52-2bfe77481271",
        "indicator--cb0a7bbd-9cf1-40ff-bc1f-83f7fb4b3264",
        "indicator--ae302535-26fc-493f-a530-761fdc9e581a",
        "indicator--dafea66d-47bf-4381-bb43-0de1727e26ff",
        "indicator--5a3ba493-2f0d-4450-bc8a-2d421d9414ea",
        "indicator--b412b98f-1173-4963-8f5e-dd89143b43f2",
        "indicator--b648c2e2-870a-44cc-92c1-55da36f0b757",
        "indicator--2902f653-669c-40bb-9a09-9f8ae4796565",
        "indicator--224599bb-f1d5-425a-bab6-fa44db6f4491",
        "indicator--141884cd-e438-4a23-b3ee-d926d95d81ac",
        "indicator--2e8a4d74-9f3c-4c4e-be91-fd7b297fd212",
        "indicator--1580ede7-1881-4a52-893a-67cd9fbfd476",
        "indicator--c1f332bf-c0d5-4b04-8170-616da1fba7ac",
        "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
        "indicator--494d2ce0-3304-4b2c-8a63-39e59aa29ef4",
        "indicator--5323a6fd-f1f4-43c9-a792-19fe3c7d1aad",
        "indicator--6e168316-2bed-49cb-8016-2ad5ecba3c81",
        "indicator--6e89de6d-2896-4118-82d2-5be9858a0d7d",
        "indicator--61ee3903-0482-48c0-934c-a83ccf71a139",
        "indicator--08aadb53-f162-49cc-8797-6f3025a549f5",
        "indicator--81af44b5-2670-48c1-9e47-a6bd59cf7d0a",
        "indicator--3eabe2e2-4451-48f3-8909-1de47b7f0bd7",
        "indicator--122de781-de74-427e-a318-706de79deb68",
        "indicator--4c1bd3a1-4435-4770-85fc-0bcd3f3b4097",
        "indicator--8b70edaa-e0b8-4a51-acfb-d9dc5d1575e8",
        "indicator--03561ffe-f6e0-492e-a515-04235aee8c21",
        "indicator--3e69a12e-6a9a-4a72-af5e-6e038869f53d",
        "indicator--0f5d11ca-005b-4994-8f79-cb07808db844",
        "indicator--0092494a-115b-4802-bcec-1d9ccf3d5411",
        "indicator--c8f58590-b381-4b8a-a1a1-e08628db21c7",
        "indicator--0b7b679b-d407-42c5-9171-610f4122e166",
        "indicator--f0185068-64a6-4459-8190-54c51cafb51e",
        "indicator--4573eb6d-4897-48a8-a88a-436106ee9a3b",
        "indicator--7e097f91-2e79-45f4-a676-889a8d735450",
        "indicator--1a2a53ab-e9eb-467f-8312-7fa75b044a8e",
        "indicator--a443f2ce-5f7d-4e8d-a1f6-0799c5e88f32",
        "indicator--501e5bd6-b178-486f-96e2-f2bb5ee9a257",
        "indicator--a7ea87b9-e833-4ff8-afbe-3fdb6cfaa1c8",
        "indicator--9b6f6355-c381-4621-a7f5-e5c2e6f1d017",
        "indicator--69813e44-9fa4-4a07-bdf0-08de408164f1",
        "indicator--8f101f7e-442c-450c-96ad-8d41309d0bde",
        "indicator--11eefabd-8ded-4182-82a9-9aa17ed78959",
        "indicator--1004736e-7686-47da-922c-5bf6c1369d53",
        "indicator--d2a040a1-7214-4a6c-8eea-5b30439d4d48",
        "indicator--227a99a5-0b61-405c-aadf-e23474807352",
        "indicator--9c15c10a-072a-409e-b447-d682d44914f3",
        "indicator--71aab60a-1ac4-47f2-ae17-f5e0376dd1aa",
        "indicator--9e3a779b-8e44-423e-80ca-d3ec34bbdd83",
        "indicator--f476b8ea-dde1-451c-b327-1a8a16b9e823",
        "indicator--3397a1fc-4ddb-45fd-baff-1fc1eccc10fa",
        "indicator--7c83910a-9f18-409c-a1b1-656ad195a603",
        "indicator--eae7e5db-61ed-440e-b496-6f803f607663",
        "indicator--dd49ac26-b46a-4f8e-89de-b6c19045e73e",
        "indicator--fd31b657-f057-4bf8-9246-aea15ae42f4e",
        "indicator--9e4e1984-561a-4456-853f-bea66f459852",
        "indicator--febbebd8-b5f1-41f9-8623-ec5e32608935",
        "indicator--f05308ba-132e-4bd3-8822-28e4e6512c5a",
        "indicator--9e6677d0-be36-4e8e-9389-932fae7b5832",
        "indicator--2a3558b1-8c25-45ec-83bf-aad830258650",
        "indicator--a3017d25-21da-4a9e-81f3-07660d7b9860",
        "indicator--ed329407-60f4-4fee-9f2e-2512f1226a0f",
        "indicator--d03108da-a26a-4f0c-9c8f-b40dfbe32d4f",
        "indicator--36814de5-0e47-4025-a2de-e04b22b4d440",
        "indicator--8e2dbca8-67a4-4f28-afdf-d914b756611c",
        "indicator--5cac01b6-92cf-4c84-bc7d-523f408bb9de",
        "indicator--4db030cc-b9a7-42d5-8b9d-7aeadc3f49f5",
        "indicator--b819eb99-f2bc-400c-9181-e0445d150130",
        "indicator--045662a0-d19d-4ce2-87fc-70b404059e8c",
        "indicator--1b23815e-f825-48aa-b621-fb3322f19520",
        "indicator--31b1cb4b-44d7-4989-903e-af6e53f6f53e",
        "indicator--07253028-fa65-4337-825e-d0d58b1f5ec5",
        "indicator--b0ade785-344b-424f-9d5e-d1ded8521103",
        "indicator--00da883a-cf24-4386-99cf-4baa956408a2",
        "indicator--1e7246cc-c279-4763-b113-c14988aef92f",
        "indicator--31c01f0a-0449-4b76-a1b7-f4ae1c48a55e",
        "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
        "indicator--5507462e-ffcd-43b5-bfe6-afe98d5d4eba",
        "indicator--c09a464a-3ec3-4295-853c-4aa1527e0dea",
        "indicator--f95f2284-6554-42ee-aa07-9f498265aff3",
        "indicator--b163ed59-c615-4fae-8a5d-b5ed5ae896f3",
        "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
        "indicator--acc7b7b8-9079-4434-b19b-16969af8a640",
        "indicator--fd48da17-b586-40a8-bd12-88dce263f83d",
        "indicator--0d7e126f-1001-4411-b1fe-c73cdc2329fb",
        "indicator--1964b692-dcf2-475e-a53e-267db264f4d9",
        "indicator--c5b2de4e-b12f-46a8-a34d-f5a5cc07cc4a",
        "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
        "indicator--13b4fda0-522a-46aa-875f-d38173d12119",
        "indicator--3e8f48b0-45d8-4dbb-aa0f-b0541548e723",
        "indicator--55ff3074-82cd-44a8-b7b0-9038a393c6ed",
        "indicator--526f3a43-20d1-4973-aa2c-a8c51123cc05",
        "indicator--1c794c87-8af9-4bb4-a521-47202ca883b9",
        "indicator--ddde6ae4-5ce0-4321-8984-bb42e07e5bd9",
        "indicator--151e68d8-0a70-4f5c-84b7-6aa45aec59b2",
        "indicator--82a0ec13-c874-4549-8024-3e14f40975f7",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--906eb17e-e7b9-436b-a83c-2097a14aacb8",
        "indicator--7e5cfe02-7130-4ed0-b6ed-4074012e4467",
        "indicator--e3c77720-09a1-4870-9d2d-871d4f382ef9",
        "indicator--6692967d-bfdc-4172-9af0-95ff97caf6cf",
        "indicator--f321b47a-fc06-4da8-b08a-c459a5ad4c86",
        "indicator--e1ce5c37-41ad-49bc-b6a2-ae2a6f61fac2",
        "indicator--c4297078-22c9-45ee-8bab-97a581b55562",
        "indicator--932d5913-a980-475b-926c-e104684c45e4",
        "indicator--15b59443-2e21-4670-be30-8f69160e884d",
        "indicator--6c23d75e-1086-4e30-b06d-a2a05892f37a",
        "indicator--7b1260cc-5468-46ad-b591-b55d7105d0e2",
        "indicator--fc9b8439-7867-4bb3-9d59-5c96e344c47e",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--cc15a2a0-e7d0-4958-93fd-5109b8ef3183",
        "indicator--ba6c918b-f5af-484c-9d09-0911227dc4ce",
        "indicator--fbc34aff-9262-4de5-912d-77baeba0665e",
        "indicator--207ab1dd-982c-4464-8a93-cd5d0b6693c3",
        "indicator--adbd99c1-f400-46a8-9c2d-676713f9a13f",
        "indicator--91d5dcb6-ce35-4bf9-a753-134f7249feb0",
        "indicator--38be71c5-9f7c-4766-b6ab-983aff75ee4b",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--4c5bbbe8-f2ae-4ee0-bfac-c78e927b87fe",
        "indicator--86003089-ec21-488e-8b57-06531026f170",
        "indicator--9719bb5a-4bc8-4719-a760-c28c8b10df33",
        "indicator--51d69f4d-b9ea-47cc-982b-5ac873c7439c",
        "indicator--d347406c-35b2-43e1-bed4-4374baea97e1",
        "indicator--9c1a5b3f-f6ad-41cd-a5f9-0baa332d6833",
        "indicator--fb6ade18-8ec9-4eff-bdfb-f174caa0d913",
        "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
        "indicator--0c9e6e71-7e2b-48d5-af47-2bf19914315d",
        "indicator--f23e2d14-9295-4727-89ed-d8c7a194215e",
        "indicator--8ed975b2-8ca6-42b4-9a8b-e41527d5e244",
        "indicator--6c166492-8271-4b04-816d-4587efbc9e3b",
        "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
        "indicator--a59c77d9-af0b-4cca-bf0b-025ebe455113",
        "indicator--6bcfb678-d402-4a1d-a2b6-b44170404cfc",
        "indicator--b045b636-056f-4f24-88b8-149fa7f12ecf",
        "indicator--5d9580bd-32be-4fb8-82e1-2f5e6f69decf",
        "indicator--548186a9-42d8-431f-8347-9af95df54cdd",
        "indicator--98b55d91-a867-4aec-af5e-98fe546a9b76",
        "indicator--0fe19022-8a21-4162-b980-9ded0d33b49d",
        "indicator--106a62c4-babd-4a76-9310-58e534904e74",
        "indicator--d06af509-7531-4e4e-9dc1-859b17042426",
        "indicator--78342350-476a-434a-b037-d9ab40aab793",
        "indicator--e258f438-7d8b-46ca-9421-40bdf06f3df3",
        "indicator--65610f03-a81d-42b4-a28c-7238d7a6f0f5",
        "indicator--98d9dde2-c1f7-4f71-a2e2-bd92be51898f",
        "indicator--0149d211-de44-4cb1-9956-2241f21d4d07",
        "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
        "indicator--340d1954-3ec3-4a00-8abf-cfaf6e0e7473",
        "indicator--dcb7cd61-cbf6-40fe-9783-681b0068a0b5",
        "indicator--5c66b249-56e1-424d-9a8a-a54d127c3641",
        "indicator--5426399c-6e36-4acf-a678-7b56cef821e3",
        "indicator--9b8ba18f-9a5b-4513-9cad-f7bcdb56aa95",
        "indicator--ec6b0ca4-b98d-4192-962b-825947510c0c",
        "indicator--36148765-701b-42a6-b356-72529ef7b16d",
        "indicator--8e1d0958-7c60-42a5-b4b4-1b8af0fea70a",
        "indicator--5bbed8e4-9a9c-47e4-9ae5-2176cf97abd2",
        "indicator--e1a9aa04-c994-49d8-a868-9f655ab3547f",
        "indicator--9999bdb7-dd0c-4413-86b8-57baf41fa1a9",
        "indicator--5f1d8341-c544-4122-b3d2-0b2245a76c1a",
        "indicator--d9045946-83ad-4432-acc8-64fedeb4da8a",
        "indicator--935837dc-8d07-487e-b21b-fc397251296d",
        "indicator--974abeba-eed5-4b08-aacd-2eedc4267cae",
        "indicator--cb6a6884-db5d-46df-8014-967cc63d4340",
        "indicator--c8c1dec5-8c74-4025-9ef3-6e7b07608743",
        "indicator--db7c5986-4bb8-473a-aea4-b08ff2cae6bb",
        "indicator--1c0afb5e-6b4b-4c39-ba10-7b94c4e3407b",
        "indicator--b353e67f-e70d-4215-9f1f-cae539da8719",
        "indicator--abcd5e78-f12d-4fa8-afb6-177ccc849a0b",
        "indicator--5497e11f-d169-4b99-be93-b6022ce6b8f3",
        "indicator--fb55a3bd-71df-4208-ad56-e0ff3f6fd82d",
        "indicator--e6d3650c-049d-415d-b439-6dd04c9f5bc5",
        "indicator--955117d7-9c5a-4c6d-880b-7ddd273dee75",
        "indicator--e035bcf6-32ed-4330-9486-5e1965993f62",
        "indicator--2557695b-25e4-48db-803e-b15eae04d432",
        "indicator--cec0b3ff-2a27-4de1-b072-d7637b407d99",
        "indicator--1fd0e459-7ff4-45bb-bb06-2ceacc9544f6",
        "indicator--706e24ef-00c3-41dc-8667-64aa42b7b307",
        "indicator--63ba1563-0192-4ad2-bf58-775e51faaed6",
        "indicator--49563307-af17-47b0-bfd5-133b2efce82b",
        "indicator--73a3eab8-030e-47ff-85c5-28f46a1d98e1",
        "indicator--fbb3ef47-17c5-4194-9096-fd06cedd9516",
        "indicator--6d34ba88-cd60-4e7f-ad73-5b58d83627da",
        "indicator--e8f74d4b-3a37-4d39-ac60-f2ea6096a958",
        "indicator--c878ed6a-9ce5-442d-a7ac-75a73fd91dde",
        "indicator--7943bac2-06d5-418d-a7aa-1802e835f391",
        "indicator--e8b4d565-5387-45f7-ba0e-ca2901cf54ab",
        "indicator--060ae48a-18c9-484b-b6ab-86db4e1693a4",
        "indicator--75fe8401-1861-47ab-acda-c0b5b98581f0",
        "indicator--35954e15-acd4-47c0-a8fd-2ec86b1193e8",
        "indicator--294109b5-ea90-40bc-825a-61f0f43fc3ed",
        "indicator--b20dce13-c096-4841-b835-b49cf8e5d27c",
        "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
        "indicator--7bab686b-8ece-41a2-88a7-9fc1a5296ca9",
        "indicator--9b0dcbea-888f-48a0-b8ae-6f30954b8879",
        "indicator--fd187672-3c42-4338-8220-e9f044773474",
        "indicator--37253c70-4cf6-4f42-8bc3-47c56cabc993",
        "indicator--2a513517-2876-4bf7-af30-315c7d6c7ab1",
        "indicator--91436eca-c96e-4bb2-b447-4f0ab8da8a60",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--a17c2d69-2c03-44d0-968b-ff1e54d1a44f",
        "indicator--4b801a0e-f39f-4165-9780-9faf50f25d81",
        "indicator--a4cb8b01-0110-4d04-ad92-0bfcb1f708f9",
        "indicator--3558102d-9670-4db1-bd53-7cc57c2eb3d0",
        "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
        "indicator--51cd478d-ac92-4a2e-a621-b6d5df4dba7c",
        "indicator--782c616c-4765-400d-b0e2-0a26972bbfe5",
        "indicator--9cd0daac-93d6-47a3-8dce-4e5d29f63059",
        "indicator--f489bb7a-0725-41ad-a9f5-8d59f79b4acd",
        "indicator--aa0ef9da-94f0-429e-af4b-ae9c8357bde9",
        "indicator--9e8f170d-3ffd-4685-8171-3926af2dd13d",
        "indicator--61b4e761-4e6e-4be4-b170-4f5133e7eb81",
        "indicator--60895f41-813a-4cc9-a2e7-df34a2ec78e1",
        "indicator--3f9fd022-c51c-4f81-ad86-ac1e4c704228",
        "indicator--bde6a336-045b-4b99-820a-43161921cd23",
        "indicator--4a947409-1c9d-46ea-97ac-e1be54c516ad",
        "indicator--f8c2e56f-3937-4e58-b404-06d22107700f",
        "indicator--7ea0394e-509c-4671-b33b-f4d469e3ab19",
        "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
        "indicator--d5fc552e-9241-41ec-9478-35ed8731106e",
        "indicator--55b53ac4-7c92-437c-8b05-644d95fe3d07",
        "indicator--18515589-f12d-4caa-875f-88abd597a4b7",
        "indicator--98de1efd-2c73-4ede-a78a-a975358600fe",
        "indicator--046484c5-ab97-49a7-8708-d0dfadd792cc",
        "indicator--1e221312-6913-4cf4-8888-1ab4a76210cc",
        "indicator--00b7b6ef-ff65-4c3b-a869-360c5b1548b5",
        "indicator--16608d46-f857-48cf-b3c4-a4fc43c7e3ff",
        "indicator--1f1e2602-22db-4ca3-befa-2ecb63ab18d5",
        "indicator--fc280feb-f7ac-4669-b400-b58b1b5dc32a",
        "indicator--5d8b030f-2b4a-4d9f-a12c-d8a0731e34ab",
        "indicator--74f96d24-4498-4359-afb2-ccef658d4e4d",
        "indicator--51b4885f-8dc1-4e12-bf79-c9e8dfd77aa0",
        "indicator--11c49171-bc8e-4233-932c-3adee3dc4a54",
        "indicator--0a41d434-f23a-4046-a897-0f7ed805d9f1",
        "indicator--44f7a70b-ef15-4d19-a869-d590855860b4",
        "indicator--89279041-151d-48af-a5ef-20a445f0742c",
        "indicator--8da62290-674b-40c7-997e-9f8a211608e2",
        "indicator--055b4e2b-7324-4fd1-9e2e-2cec24e293b8",
        "indicator--28093fa5-b30a-4a2f-98a4-b081c7fd8dc0",
        "indicator--c9d6cbb8-15da-4dfb-b523-774a74dde9a9",
        "indicator--81615859-05b4-4e73-92e7-4d67f241bc12",
        "indicator--8ef23e84-063c-4b80-ad72-abf626624616",
        "indicator--ad3c6495-a4a3-4d03-b87e-3644cb705c48",
        "indicator--75fd664e-d295-4495-8770-034eb8885c9d",
        "indicator--8610047e-fb6d-4b81-9a69-c000ad285f1c",
        "indicator--b1095af2-b1d8-4e87-96e7-6173e7b6734c",
        "indicator--3dc0c127-e809-4604-81dd-dd12a6d46b9a",
        "indicator--7697e62e-a969-4209-8c8b-330ece866aaf",
        "indicator--378310ac-cc42-4994-b75e-74557937c06e",
        "indicator--cd86f8f4-d184-4650-b4e1-af16d41b7a06",
        "indicator--db8f7231-4efb-48d4-9d58-8103221e04ba",
        "indicator--436bc86b-8c28-4939-8972-18359f35b2e8",
        "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
        "indicator--4a25b819-7360-42fb-9a7c-10a1f404602f",
        "indicator--73f66644-728d-4952-839a-d6d8ac2ea055",
        "indicator--16db9f43-bcb7-47d8-8f00-3b82b8472255",
        "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
        "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
        "indicator--ebe63826-f361-4799-8364-8b34b0a5bb3f",
        "indicator--bf060765-b95d-4d59-9d47-8104c6be6cdd",
        "indicator--e6cecadd-9e44-4b5b-8122-d389fff3a51c",
        "indicator--3034fdc3-8320-4c8b-84f7-6c2860724bcb",
        "indicator--487c82b8-5e7e-468d-9bbe-5df4d7fc2587",
        "indicator--c60b737a-5c34-4f28-8c6d-1d2f4e136e90",
        "indicator--6371437a-b1fa-4b66-b2ff-eb158b46c715",
        "indicator--a9b15d9a-5628-4463-8604-5754a33138d9",
        "indicator--9a1da3b5-534b-4d43-9037-3a2c5128253c",
        "indicator--61890b08-58e5-4335-ba08-a92658e275fe",
        "indicator--c9757b0c-c0a3-4331-be96-d5bc24cde493",
        "indicator--f7f3ef71-fc58-450e-abbd-4bd10a7161b6",
        "indicator--7a7d6936-27f4-4c73-8ad3-83201c9a1668",
        "indicator--020acf2f-55a1-41b8-91b0-5790b0ca3be3",
        "indicator--61b0f9d0-d321-4c6c-ae8e-ac6fffe9c2f0",
        "indicator--629540f4-a8f7-486d-b556-db7a47dac753",
        "indicator--41c02011-d35b-4983-8a81-30157648a20a",
        "indicator--ae542a89-1fe4-4792-93ab-fa1be45b3a9c",
        "indicator--1976c0df-3a1b-441d-b9af-96a2b53aa358",
        "indicator--bddd9184-4f86-4692-b720-7260e61936e5",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
        "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
        "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
        "indicator--d9b5c74f-09c6-4b4e-b6e5-672c57f8d71b",
        "indicator--41c39de7-6682-4f74-9dbf-a4b12830b308",
        "indicator--4b49196e-7b4e-4c74-bc4e-52448b804f8c",
        "indicator--560064df-2cfb-40e2-8af8-bc86df615393",
        "indicator--6cdf000b-18c8-435a-81c3-c7f983582f48",
        "indicator--41497bfb-f484-42b8-8133-cca0a21ad78d",
        "indicator--ae97c78e-3b97-43fd-977a-bc209d363a68",
        "indicator--9065c866-b16f-4ac0-bb6e-c7d8a685e70a",
        "indicator--c5d2674b-a105-4f58-bde8-6c64eb71853f",
        "indicator--bd2b5763-148e-41ad-bb26-d59e1494603e",
        "indicator--cdfaa3be-9f21-4b46-aa3b-e6e690fabb23",
        "indicator--ee1130a5-34f7-4734-9497-e2775d4370bc",
        "indicator--a16780f2-ed05-4611-b0ed-85f84d3bbbd4",
        "indicator--cd524bf6-4f52-428e-b863-7f7bb048a559",
        "indicator--74f54b94-3478-4dea-9b72-f155ceda1ce0",
        "indicator--59e11966-28fe-42de-9a19-03b81066df88",
        "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
        "indicator--401678fe-4cd5-4337-a95b-b8fb24511817",
        "indicator--34669909-db39-4fc8-97b4-ca02095ac164",
        "indicator--fdc1783e-1828-4e95-bfad-8dfb284c2e85",
        "indicator--a50b49e3-230c-4260-bb56-8a5d6d28025c",
        "indicator--8966c197-4acb-4380-b43c-100012678c66",
        "indicator--2fe8116d-7234-47ec-a46c-34181a91868e",
        "indicator--d76abae8-cba0-47b2-beb8-28fa18183250",
        "indicator--e376c9b8-9a13-4bf9-83c4-2bc1851491aa",
        "indicator--544a8398-86cf-44ac-a669-f9cb956425d2",
        "indicator--f6806d7d-54f0-45af-ae82-3e390c0816ab",
        "indicator--c08ba408-15f0-468a-b285-16235b87b826",
        "indicator--0dc6c65a-01c0-40f8-8017-d4cbba3c5d1f",
        "indicator--1257f291-ec60-455f-957b-2d81e60e99d6",
        "indicator--d13c17cf-33d3-4434-86d3-276cac1c36d4",
        "indicator--fbdeae1a-730a-472b-b89b-100c4f9627ef",
        "indicator--f5f62157-b3ec-4ad3-80b6-6723067c88c9",
        "indicator--6ec9b8a6-8aa0-40bd-898c-413bbb2ba40b",
        "indicator--5f4fbe59-5d7f-49c3-8b94-395558fb6a93",
        "indicator--0cfff881-bef9-4664-a519-3b64d912a617",
        "indicator--3bb87bd1-abb3-4fd1-a8a6-54a00ca01be9",
        "indicator--c6665c36-b35f-47a2-b1e4-0de57e817a76",
        "indicator--bde365c8-d59f-422d-b292-850ac3f066e8",
        "indicator--9a19a009-eb96-402c-8c5d-8d391d1ae307",
        "indicator--86d373df-5b4a-49df-b516-d153ad81fe70",
        "indicator--d250efd4-06f9-4631-8be5-9e69b9c6df1a",
        "indicator--dbdbecba-7f6b-4b6e-a03c-4c1961e4ea60",
        "indicator--2da53215-990c-4ca6-9acd-94a2ad385114",
        "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
        "indicator--c7b85c07-2572-4434-b1b2-6a595f764dc5",
        "indicator--03f5d6f4-8c32-4e9e-b800-377bb84000ba",
        "indicator--70ff47a9-c696-4839-9b2d-1988651f7b43",
        "indicator--c846e5c2-0183-4fe2-80f5-a355b167a58f",
        "indicator--7095a357-57da-4aa3-a250-63514a74d30b",
        "indicator--bb4f14ab-ac8f-47d7-ab31-eda1b813e990",
        "indicator--f1da2226-99dc-47a8-992e-9fc3067393fd",
        "indicator--78deb603-9828-4483-8e62-dffe3b1cc263",
        "indicator--b5aeee81-50be-45fe-ae7e-ae3e54929bd0",
        "indicator--484adf9d-b8ad-4dce-8793-d354390fd28d",
        "indicator--5d8473dd-87a1-471c-b9f1-b010099ed76f",
        "indicator--5c6ebf13-fb48-4b02-90f5-126c207a577c",
        "indicator--50b40bbc-dacf-4364-97f0-6a5d77aaffa1",
        "indicator--57bf2bb8-1e7a-48ae-a59b-417bcad306e2",
        "indicator--c86ee2f4-5b3d-49a5-b4eb-8c848f25425b",
        "indicator--d0d5a31a-4960-42e3-9acb-2f5a639cd1c9",
        "indicator--4cf52972-5540-4b78-8819-0e10498ffd67",
        "indicator--5def2fa7-741e-49f6-af24-1f6134aacc47",
        "indicator--1f2c7aa9-9d7e-45a4-9ea2-191069413b9b",
        "indicator--88f1618b-ae5e-42fc-abcc-28660e5a6b0e",
        "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
        "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
        "indicator--8f9e6afb-655b-4831-b1c2-6d9a6adf8aea",
        "indicator--581fee53-0e54-4025-a489-bbbeea5216e5",
        "indicator--a9b0e37d-1524-4d4d-99b8-310883f2efb2",
        "indicator--506d9e3b-7fe7-4a33-8c2d-6e8f4af94d3d",
        "indicator--8db873b1-31d7-41b8-9a2a-3d60983bd39e",
        "indicator--8df3b778-006d-4e8b-9214-c21ff5abaf1c",
        "indicator--21c64823-bf35-4c7d-b756-eeddd9b8bd3e",
        "indicator--fb61922e-e49d-4a2c-9eb7-382b7cda7c75",
        "indicator--48f31d44-a6be-4621-ada7-e37e05fdeeb7",
        "indicator--c8cfab5a-0eb5-44c2-9250-6c9a0caaccdd",
        "indicator--198fbb68-e263-4aba-9982-41fcc994b4cd",
        "indicator--717bc534-d0f7-4c08-bb7c-b7949b883755",
        "indicator--0e20ba88-c146-45c5-a5c1-7c334ddb29bb",
        "indicator--5b3c0f10-7832-449e-8050-c3bee9222203",
        "indicator--9653c142-8f1d-4e99-83a1-dfb7ec379d81",
        "indicator--03d7ddef-9baa-4bb2-a913-5d9ce89887c8",
        "indicator--e7aa016c-f901-44f6-812c-8a1c5671294a",
        "indicator--6f8644d4-71a0-4f1a-ac6b-9971fe076fd0",
        "indicator--cdcea301-8cec-4a26-ac4c-ee9510e5a569",
        "indicator--4c2cfc15-f353-46bb-8699-0a4aea2253cc",
        "indicator--18a3c21a-c249-442a-a497-e371d9968806",
        "indicator--bb9f3778-3840-48d4-8641-7e579b55ebb2",
        "indicator--32022e19-a268-41a3-bd5b-160175e6f179",
        "indicator--efd67ebd-a468-4798-bd7b-b39d4a15c611",
        "indicator--d10ac882-5034-4df3-b87f-a3d19570ad39",
        "indicator--9b8814d2-ce40-436e-85a6-2e9c6dacb3a8",
        "indicator--6e57d733-d64d-45b4-bdf8-a534f3b1e69e",
        "indicator--f1f9789b-86a1-4a2c-bb31-146c3f650182",
        "indicator--165ce252-d04f-4d72-8d6e-a24e15a84f00",
        "indicator--27986a15-76ed-44a1-abfe-738fe78e23ed",
        "indicator--da585f28-7473-4102-8035-e88fecb29aa1",
        "indicator--fd08c435-849d-4fdb-8be4-356555fe51c2",
        "indicator--30333070-8824-4c5a-ba93-2680003f110d",
        "indicator--27852f18-505c-411f-b330-46fc191be61a",
        "indicator--322ef0f8-95cd-41f3-990d-ca40fb8a65a7",
        "indicator--01c4dc4f-9873-4241-8dc9-b82ca12e49e7",
        "indicator--4f97f50e-4c6f-432b-a0f7-9090aff1d10a",
        "indicator--83c3d7dc-96f4-4031-bac4-e5b2de8ad66b",
        "indicator--b85044a7-0716-41fb-91f9-2f15f39303cf",
        "indicator--df7fae15-fce1-4f3b-b2ee-9042d056c0ce",
        "indicator--0a6217b6-08e5-48ec-b9f6-6a38fd9bc9ac",
        "indicator--9808a718-3ab9-4c42-b6b3-aee79e2e0be3",
        "indicator--02e276f4-9f82-4675-9a74-c65fbf8ed80e",
        "indicator--36775c5e-2ac9-474f-87f3-f3489539950d",
        "indicator--c29b4156-f26c-4731-a534-0c422eb5a872",
        "indicator--62f6037e-41b1-4230-83bf-496a01350a0b",
        "indicator--9d0967c8-0ec0-44ef-8ab5-aa7517abd3b2",
        "indicator--3c2e4a94-46d0-4f93-a849-a62419736aaf",
        "indicator--c5fc6822-3375-465c-bad6-e7d57b4e46a0",
        "indicator--c7abcf7d-5732-4442-8032-4b6472cf3ca3",
        "indicator--933349f1-b952-421e-a52f-c3c8f7a47065",
        "indicator--d2f1c257-33a8-4a4b-b652-f2f46edc3db2",
        "indicator--aed05d03-d8a2-428c-a77d-9f5b7d282245",
        "indicator--c98a3b5f-436c-457c-8996-c6dd37c6cfd6",
        "indicator--459b8709-d3d9-4e5e-846d-0a8f6dd8809a",
        "indicator--208b494b-cee5-45d6-a3ec-0be330017c1a",
        "indicator--e9d6d28b-d5a0-49dd-bdce-0bf93c0e6d34",
        "indicator--40689725-0ad6-4cbd-a42c-c884ef00a04b",
        "indicator--220213cb-8ceb-4528-a5be-6a147490b8d9",
        "indicator--05be4457-f60b-4832-9b66-e11904439904",
        "indicator--929c0893-3bf0-4450-bd95-271a37907beb",
        "indicator--595b89a7-2485-4c21-b1f9-2c2757a5cc65",
        "indicator--fd01df41-1a81-42ff-88e3-e7b40911c86e",
        "indicator--60e6dce9-8b80-4f0e-bf41-30be77c94225",
        "indicator--f57d1641-f1aa-47e6-98d8-166b2a1ec6f8",
        "indicator--6f607664-11ee-43ff-b2e4-1122f424af45",
        "indicator--0991b459-1990-4982-b13e-d774563b885e",
        "indicator--9b9b86ef-c95b-4bc9-98b3-0dbbb5c478b9",
        "indicator--98e49c9b-180e-4814-bbf6-f23555bd87b0",
        "indicator--8a0b2752-2ac1-4925-8dd7-59d58f8eeb3a",
        "indicator--764ba615-e128-44bb-94d4-45534eb61bba",
        "indicator--41887a75-9db2-4941-b924-805c0f4c8b78",
        "indicator--f28e7591-da7c-4e00-b424-2a3ea9a09fb8",
        "indicator--0d4f5759-1050-4685-9cfb-30fe7a666373",
        "indicator--515bd823-4a4f-4fa7-9f75-522433cccf85",
        "indicator--a05f1bc9-a03a-4945-807c-27d124a8553d",
        "indicator--632d06da-2c54-45ec-8e7b-1db5435e5e74",
        "indicator--d7a0708a-59cc-4260-b00e-a815488cb6b4",
        "indicator--2763841b-dd58-4138-b663-5067824ea181",
        "indicator--ad66ec34-5c5d-427b-877a-d54f9b1b089d",
        "indicator--40e12be6-ae86-45f2-a417-60fac9c562d7",
        "indicator--6dfb676d-fa2f-4256-9707-bd5078ffb276",
        "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
        "indicator--bf158b07-8275-4a1f-88f7-cc72eb118837",
        "indicator--2586888a-2f4f-4ef9-a63c-d4a59cbdd2b1",
        "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
        "indicator--1b8b57ef-b643-4594-ab00-6bce73935c2e",
        "indicator--218682a0-c3b2-40db-8c62-aaa3887df362",
        "indicator--31a6f2eb-fc2b-4d8b-b88d-18d5c6e33e1a",
        "indicator--b5f2e74f-d7b8-46cb-98ea-7bafd2509bb3",
        "indicator--3d9700c4-e2ee-4e62-a961-a688cab7d4ee",
        "indicator--2dcadb27-2ecc-448a-8b22-9fede8618a24",
        "indicator--8eee3341-81f3-4450-aa66-fddfe840d4a8",
        "indicator--0793acd2-c4e4-4047-a9e3-358238a4766a",
        "indicator--145adc30-2a52-4b52-879b-99e6cca48ef2",
        "indicator--5fca32a0-7f3d-4210-85ef-69609c464243",
        "indicator--46acbabe-9426-476c-87ec-7b64ade4518d",
        "indicator--943a20d6-d7bf-4a88-a170-ff562bdfbb6e",
        "indicator--c19abbb6-4c1a-41d7-96ed-92febe561c49",
        "indicator--11b43278-a96e-4ea0-8ff9-bde9b062a075",
        "indicator--1d814bea-8778-4667-8d9a-7773e8adb693",
        "indicator--e0835a71-a575-4f39-af2f-808ef78e3cad",
        "indicator--3d12547d-8143-40c6-a589-5caad4d326fb",
        "indicator--1ed39798-75f4-424e-a0f3-8bc5234a000c",
        "indicator--31e6df10-53d5-4d64-8fc5-a2fd833b732d",
        "indicator--1bd16588-17c6-42d0-bcbc-a2116691ab45",
        "indicator--e8f2a6bb-f205-46b1-8331-b8569c09ce7e",
        "indicator--78493126-f11b-4a6c-b169-6f6328322686",
        "indicator--d2f9aff3-86c8-404d-9400-a8f568316b4d",
        "indicator--a8ae6a3c-af48-4a8f-92c1-98bcd601b2df",
        "indicator--258f9adf-d3ba-47b4-9c55-6d1e48f1d39b",
        "indicator--2f0d5dff-2d01-448b-82ab-967bed2f80cc",
        "indicator--78e2af2e-1f8a-44f0-b203-4f0b7aeb110f",
        "indicator--94d17ef8-f813-428e-ac27-d0882d1042bd",
        "indicator--c83af17b-4631-4841-8fbb-0fa983ddf9fc",
        "indicator--afac0980-7d22-463c-80ec-868748b6b0f8",
        "indicator--15a96ab0-223e-4172-b251-550a4daa9fa2",
        "indicator--1d044d19-68e0-4dd9-abc1-4271aa530bdd",
        "indicator--a8812640-b54f-4a42-93be-ea3c0686dfc9",
        "indicator--606c4523-6db1-49f7-9849-f0b02e4d8ffa",
        "indicator--795586c5-d74c-443f-bd31-c41f41425eb2",
        "indicator--e19e2a46-ea06-4a56-b25b-ef27b1d521a0",
        "indicator--aff37510-7dad-4687-9eb0-a9d0987a432f",
        "indicator--485cff79-30c6-4952-84eb-27a0a4785105",
        "indicator--6b485feb-892e-4fc7-84f1-1813456171ae",
        "indicator--301a197d-04fc-4522-b12a-615f0d910271",
        "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
        "indicator--5280637d-f44d-425e-a7a8-7a1a53451cc6",
        "indicator--4843d525-fcaf-43ec-a271-0f20ffb0c42f",
        "indicator--41dea916-faa1-4282-a41d-fed08add327f",
        "indicator--5c6426f0-3519-48be-9859-db09d59c10c0",
        "indicator--7c830e8b-89dc-46a3-bbe3-da575188c5e1",
        "indicator--390191c7-1307-4d90-90b2-07673d6e332e",
        "indicator--2bdbf8e3-1974-49fe-9696-6ba2beae91c1",
        "indicator--5e61f47a-093f-480e-a549-612c76a1ef86",
        "indicator--b94457b1-8b98-48d4-bdc0-3645e6cc7a81",
        "indicator--4d6f2e20-6984-4b80-999b-b98169784806",
        "indicator--86646c59-18ae-490d-9870-076e747d923c",
        "indicator--1ea5de94-d8f5-4ef0-92d8-f57459f9e4ca",
        "indicator--380dea1e-5ab2-4458-9a4a-8c07d7b43358",
        "indicator--819072aa-8eda-4c51-ab66-517e9ae5a2c8",
        "indicator--3ea7d423-6a6b-42d5-83cd-eb706094b8d9",
        "indicator--e866a615-a212-4b50-9366-62ecfb06df53",
        "indicator--e4b1120d-f8c8-422a-bb0b-6647ebfff5ce",
        "indicator--5f8a9013-b575-4088-a869-39bdfe339012",
        "indicator--6e2ecb29-d08a-46a3-8dfc-5221ba4af758",
        "indicator--21d80e89-0c4c-4bfb-8d66-1ce864b70f0a",
        "indicator--046b4ee8-0e6c-4127-951d-e5323820f69c",
        "indicator--49dd85ea-94eb-4dbc-be0b-1e1832de3174",
        "indicator--da315a0d-3c18-49cd-bbd3-f125de8768c6",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--f9fb1c66-65d1-4a30-aa66-f84892f093a0",
        "indicator--feb2410f-f181-41f9-80e5-26c1bfec0def",
        "indicator--f6f4fb69-e71e-4828-8ede-0412d1a56d9a",
        "indicator--efc2fc6e-9df2-438d-9fd6-43f26ca93fc4",
        "indicator--00e1863b-b931-4cec-960f-185add6e072e",
        "indicator--79d4877f-8632-4c8d-b5c4-74ac0be0c167",
        "indicator--2eebb645-49ec-4964-809a-077508a5dadc",
        "indicator--9545acec-9075-4845-89bb-479912e5e610",
        "indicator--821a4e0d-da33-45ef-9543-e470f5bbaef4",
        "indicator--5b6558c9-d1ce-4c39-9280-53f80a392922",
        "indicator--98ed9db0-fe3d-4edf-8740-fb420b703476",
        "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
        "indicator--b07c1486-39ce-4f9b-9891-544f36d3454f",
        "indicator--e60a0632-a32e-461e-aeba-76b48411e7fa",
        "indicator--2d80f0b3-eeef-445e-83d9-7b94f6e50850",
        "indicator--abfdeff7-a03f-48c4-805c-11aba2c574bc",
        "indicator--d132820b-bbfa-4a78-817e-65743706751c",
        "indicator--5a7f829a-a562-4c65-bfaf-42fd0009b820",
        "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
        "indicator--2d527bd1-edb5-4c01-8460-ecc736f9321f",
        "indicator--47a16119-fb6c-4ab6-842a-247316e74d1d",
        "indicator--3ed08db9-7404-4d0e-a375-e119159182b2",
        "indicator--1a75f5bd-8e8e-4f11-8310-c5b215eb8565",
        "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
        "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
        "indicator--d407bcd8-ad58-4dfb-a6c5-39b15a6ea991",
        "indicator--4e799108-8c43-4be4-a25d-65b322684e16",
        "indicator--a7ae4174-9a35-4225-afe4-342e74751a0c",
        "indicator--886ae124-2d36-41a6-88f6-03383b0f42e1",
        "indicator--54a8cc90-e226-448e-9a15-89fdb7dfad7c",
        "indicator--8819c270-e944-442d-a278-b2e4a52b188d",
        "indicator--b9393dde-4ae7-4e26-af73-d81d37f89a47",
        "indicator--afcf3f8c-1531-4c3a-a0ec-a1c5fb53668a",
        "indicator--e2aa08f1-6638-42a3-bb52-e921a3d34faf",
        "indicator--7362e172-530f-4c7e-b042-0867fc5aad3f",
        "indicator--42f864af-10b5-4ee6-a464-d599e56a96d0",
        "indicator--0cc2821e-5dc9-4b8c-b9d9-bd8c7434abaa",
        "indicator--f5a154f7-4406-4f70-9dcb-6c3065b7eb53",
        "indicator--f242966d-6eb9-4ecf-92ad-8cf1d8439151",
        "indicator--6747dd19-0fd5-475d-b6a9-0c42a12dccbf",
        "indicator--3b345870-2f37-468b-86ad-ed9175c93a62",
        "indicator--3d2afb89-00e6-4772-9d91-9686a9df7c00",
        "indicator--76003846-2009-4180-9e0d-f95980728fed",
        "indicator--b3da3872-51d4-4a54-8812-f0d1c7e14736",
        "indicator--0d3bb8cf-b7f3-46c7-b357-2a5f3fd2b549",
        "indicator--375bbac7-8d08-412d-b3db-8f04f737243c",
        "indicator--c206b923-4b51-4bae-ab54-b2358489c453",
        "indicator--01ac56dc-ed05-4559-bb31-dbc1396964ff",
        "indicator--3f467f41-d44d-4517-a9f3-2d657fdfe4ee",
        "indicator--abd93a7b-1c2a-4199-81e2-ca81e3508368",
        "indicator--cad82ac0-f0f0-48f5-be80-c773fe17f649",
        "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
        "indicator--30f3d151-b254-4285-a054-b47c953279af",
        "indicator--aad36837-973c-480b-a577-b0f6e025ea10",
        "indicator--46ff4cd6-c635-46b0-ad17-19df42e2733f",
        "indicator--a94435a9-7213-49f2-9691-70e1651fca32",
        "indicator--5568d07f-1b6d-4316-b2a6-d1d0414a7f11",
        "indicator--8e4c6cfb-fd4e-4f5c-8385-75231417140d",
        "indicator--198b008b-de57-4119-8a1d-a5539db93185",
        "indicator--867f5a72-165e-4979-93d1-e27f4749cf98",
        "indicator--e95dbc52-cce9-4ee1-95db-5b79279ff8d0",
        "indicator--5d7f98a2-951b-4afe-b340-fb4234ba8a43",
        "indicator--5ab202cc-13cf-486f-afab-5b20c8390854",
        "indicator--48c2f9ec-66ae-47d8-9184-b743b82d22dd",
        "indicator--1d433c87-17bc-4f1d-9e83-871d43831326",
        "indicator--52e0c128-0f6f-4e4d-9db0-e3cd947521f7",
        "indicator--a264d333-544a-489a-a03a-9490316b919f",
        "indicator--7843eedf-9be0-4427-9cab-8746bd594515",
        "indicator--e4c9187a-d97f-4a16-a3c7-43142d47c545",
        "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
        "indicator--adac3497-ef51-4e83-880b-0fdf4f2c844a",
        "indicator--7ff08381-104e-4a0e-84d9-c9670bdc433c",
        "indicator--afd0169d-ab65-4253-b0f8-87a67071c6c9",
        "indicator--66db2039-57a9-4425-bcbc-fd22bf71c2e0",
        "indicator--9dc13697-570b-4e1d-9137-e7e4ebd83f75",
        "indicator--34344c3b-1cb6-432e-b47b-3500cadb7322",
        "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
        "indicator--4a8e9fde-1ad0-49ec-a7da-457e0da973c8",
        "indicator--0d0e9c57-88c1-460a-a079-a72b535a11a6",
        "indicator--6cb146dd-f13d-40b5-9c84-3dc14ac8cc83",
        "indicator--ca2fa4b3-b55e-48ff-83db-d42ead446248",
        "indicator--4fe7e189-0150-4b4b-9ba9-44c31e5c587b",
        "indicator--bb07f921-22f0-441d-8559-2c12fc44804c",
        "indicator--70f65642-c4af-429f-ac05-2dad3709e21c",
        "indicator--93787edb-90fd-4b37-8b1b-e2ae8e7064de",
        "indicator--cd67f199-85df-4dba-ab26-b6a553ee33ad",
        "indicator--b1e4c4ea-84fa-411c-b2ea-b0d769b1613e",
        "indicator--06c4fe06-3693-4486-9b1a-da22c13cd0b9",
        "indicator--1f0f53cd-ec7b-4933-bef0-80a113fa12c5",
        "indicator--25ef5c57-a5e1-4337-91fc-da4cd2e210b7",
        "indicator--5730d05d-406a-46fe-b9cd-8efe90699b08",
        "indicator--70687746-088c-4769-a69b-5d70cb92226c",
        "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
        "indicator--d3f5a9e8-16e3-403e-b603-bfe707f67634",
        "indicator--7d328429-ed89-414a-ad14-943a3a342219",
        "indicator--c36155d1-d389-4d60-a014-b9be3dac4f4b",
        "indicator--7f2d0efd-416e-4b0a-b6dc-31f8b57a0c2a",
        "indicator--06b896e1-e180-4750-90a4-75fdee807a12",
        "indicator--bf77d3ce-1e5e-4fad-b4b7-d58b7dcd1e10",
        "indicator--1b7ff201-66bd-40cf-870e-a931acfa6fa1",
        "indicator--985c1fcb-f4c8-4fa7-a11a-dcc84591853c",
        "indicator--a366b5c8-28b0-4467-aabf-98f57f99f01e",
        "indicator--9a67c57a-050a-4fcf-8baf-2513bcdfe85a",
        "indicator--43fc7953-2520-4b3d-98e1-8df8049b5387",
        "indicator--cb5e47f3-95a8-4d1a-905f-10f481c31562",
        "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
        "indicator--bd6504ca-1f3c-4ef2-852c-4851e7f990ae",
        "indicator--3c65424c-1d34-45bc-9ee9-38114cdfa836",
        "indicator--309e6a42-aa99-4c68-8d26-93421f3a6cf0",
        "indicator--2d0adb7d-a7ec-430d-9e09-4c3932287ae6",
        "indicator--dcc0c787-3972-496f-99be-8a90d75bb601",
        "indicator--b76dc45a-522c-4571-9f37-a70f5d448963",
        "indicator--f82786f8-cf7b-461b-81c3-5111339c9286",
        "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
        "indicator--ef22fe47-9961-4c8f-8544-d045d0f5bad6",
        "indicator--94602b99-dde6-42eb-8d9e-ea38456a8b12",
        "indicator--83aa3404-2005-40e6-a5c8-f5f45d1ad1cd",
        "indicator--b99cbdd8-c02f-4f06-9154-f986153902f7",
        "indicator--56172a8c-f5cd-4b6d-9773-31d7d56f50c3",
        "indicator--7201f965-c55a-4ccb-a0ee-5d33fe7c9240",
        "indicator--5cf8cc77-df47-4551-b279-f7ccab180e16",
        "indicator--71d53e3f-f46a-498c-9520-aacdb6c97f00",
        "indicator--abe28c0f-2399-4c25-bba1-a9427e6dcbb9",
        "indicator--014d826e-cee2-4a9f-be5c-708bec4469c8",
        "indicator--c6cbb247-dd37-483f-a8b9-463a8ea737f2",
        "indicator--619eb32f-26e0-4e34-a2ae-1b4853ed657f",
        "indicator--b9e6416b-7984-4389-baca-d0b564e5bdd5",
        "indicator--95df801d-5bf6-4a2d-9c6c-c67c3eeac5df",
        "indicator--3b0a6a84-e570-4fd5-84a4-b7006a1aee0e",
        "indicator--1d57aebf-5a5d-4dc4-aaa1-6b62fa2a728b",
        "indicator--ad47ddcd-ef88-425f-905e-79c31925b83f",
        "indicator--14c48c52-d52d-484b-b09b-bf2439085a84",
        "indicator--ad1e8d8b-4fe4-412b-9eb1-c7f215dae840",
        "indicator--a28e6ccc-08a6-4142-9cc7-80e853b9af72",
        "indicator--166a3289-cb60-4130-88d9-201a00a7e0c8",
        "indicator--863928e1-2d63-470d-855c-11dd469b0ef4",
        "indicator--619b3424-58b2-4fdd-96c6-e5b6f7ef1388",
        "indicator--95e22142-bfe0-42b7-aab5-148d0b5ea825",
        "indicator--c047002f-67c7-4d2e-81c6-fa684f0c5dd7",
        "indicator--1b9a4185-1dc5-473a-a149-e0e133659d5f",
        "indicator--ffff3f1d-b2e3-4c17-89ef-b28fb9577851",
        "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
        "indicator--0aa42c6e-4291-49bd-b6ae-5255f9f47dea",
        "indicator--4216f86f-e279-432e-aad1-d68537c0eee4",
        "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
        "indicator--2082d875-6236-4153-9cd9-2504eaf0f09f",
        "indicator--c2b3a7c6-fd16-4e88-9757-8007df60d118",
        "indicator--9d2f3eb3-6444-4799-ba3a-9590a246a4eb",
        "indicator--ffc4d498-4260-4ff5-a2fd-ca8714813967",
        "indicator--97c85238-6552-4526-b5ba-3fbc1e38181b",
        "indicator--f9bb3408-fbf6-4d79-a449-23f4ecd2679d",
        "indicator--b7ea1b11-c5bf-4c1a-8d71-aae9bbd20d80",
        "indicator--77f6999a-dbd2-4b69-83c1-5145fcc5fba6",
        "indicator--8ac35389-5642-4fa8-8c1b-940b0455d971",
        "indicator--21198a9b-8615-4ec1-9391-ca22ca3a6250",
        "indicator--1fdf7c5c-afe7-4512-9f0a-d0a1335e56b3",
        "indicator--d7f841a1-9c3d-4b8b-b2fb-485e8f2e6319",
        "indicator--3a395ffb-c356-4224-8340-fc12027cb42f",
        "indicator--39c26929-bb42-4ef2-8dbd-8ba871f6cfdc",
        "indicator--c9903361-8070-4aad-81a1-912b130c7bb2",
        "indicator--dc096fd5-9806-4b7b-a787-e30ca1f8561b",
        "indicator--a9760136-9543-40a6-9398-99f6fb34a8f8",
        "indicator--ed2d26d0-8e62-4375-a2cb-a8db03ec57aa",
        "indicator--4dc0e723-bb5c-49cb-a694-36c21ce3fc58",
        "indicator--15448d68-5c30-4a1d-bf0f-d7df52302793",
        "indicator--5b1b5a17-7cc0-4555-ad66-86a1c9bc8677",
        "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
        "indicator--da6b8046-f73b-4f6c-8826-e955373a4b4c",
        "indicator--ac687227-7272-478c-bf2e-09763b30a0df",
        "indicator--d85e305f-3b88-44f2-8157-a52d7a7e7d5d",
        "indicator--143797c8-40b0-466f-82cd-e90a2e1e746c",
        "indicator--d6a8a2da-344f-4a4c-bc57-783c99bbca73",
        "indicator--190c2be7-d23c-4a8a-901d-fadfc0e560b0",
        "indicator--52794779-17cb-484a-9290-22119465b1f8",
        "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
        "indicator--cf4c60e7-2917-4dfb-aa46-2806cf64384c",
        "indicator--1ed169d2-b42a-4d4b-9615-c56708d49679",
        "indicator--48bb4e69-ff25-46a6-8145-3379faefbec9",
        "indicator--b4f015fc-a263-4bd4-8c76-4521f62c7769",
        "indicator--bd4fbce6-9e10-4aae-9e86-bc7f87965d1a",
        "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
        "indicator--d3bbd81b-8093-46bc-9212-8a0de5d0db01",
        "indicator--b7c731da-da6e-4aeb-97cb-f93f8a5adfc2",
        "indicator--b1142d21-fbcd-446b-87e1-e80c7f352abd",
        "indicator--b55f7809-ce73-4d05-b5de-c41d346bc5aa",
        "indicator--4871d36e-a8c7-4ed7-aa87-f17f7e7c4a59",
        "indicator--cde53982-e31e-4cad-bba1-e71b24a2a744",
        "indicator--a195f2d3-78f3-446a-9308-eea7d514635d",
        "indicator--622683ea-2cc3-4923-ae7c-6f598c51c7a3",
        "indicator--000e7147-b14d-46bc-b6c4-dc91a4511b64",
        "indicator--30dc4a52-f414-44ce-8271-dc248942350d",
        "indicator--52302fa1-78b1-4965-a8bc-79c150a4462d",
        "indicator--6b6cf599-2368-49d6-a6a8-96d2f7d9723a",
        "indicator--ac292700-c845-480b-b1d0-803a17f23c11",
        "indicator--2189844c-a6b4-48cd-bddf-d32ae1f43109",
        "indicator--dd278c73-4207-4b8e-a3b6-1ebdf49e1c33",
        "indicator--96b96327-5f6a-4a0b-80e8-b32bb0877c49",
        "indicator--6140bff3-2c78-4e32-a9c9-aed4e7a85c97",
        "indicator--d4fefa21-faae-46d9-9115-a5012f8f9247",
        "indicator--086555f0-c1b3-45b1-80ae-f334d5eefb0f",
        "indicator--45ede1d3-6188-43f1-9b7a-ebc2eaf33b52",
        "indicator--f83fb566-c2b8-4f96-96b4-9e48c778f6e7",
        "indicator--6ea87418-cb8f-443c-af06-c9ba93010e0a",
        "indicator--444f4b35-58f2-4418-a8c5-84cf8bf2e643",
        "indicator--3be54320-196b-4a51-8b18-148395f02002",
        "indicator--117ee56d-c4ea-4616-972a-a295ce22aa29",
        "indicator--730e965c-374e-42c1-a0cd-211be8980f46",
        "indicator--d9db45fd-6799-4473-802e-aff1f3aa7ce7",
        "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
        "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
        "indicator--15ebedc5-67bf-483a-b9fe-b132d32f7ebe",
        "indicator--84cded69-a10e-4fdd-ba75-8f90fddefc22",
        "indicator--21cbf263-b6bd-48e9-a94e-5d048949bb40",
        "indicator--03bb5522-b309-48a6-bdbc-3df28930a313",
        "indicator--71cfa409-d1c5-4455-a7e1-2dc5afe8bbe6",
        "indicator--378bbf40-2daa-4961-8bd5-a5bae6f98684",
        "indicator--40bd01e0-afa7-42de-ad06-fdc26292a817",
        "indicator--3666ab20-1b56-4d7c-a579-4e23a7617c3a",
        "indicator--13e4a5e9-83c3-4036-8200-64148e577f8f",
        "indicator--dac13386-c266-43d5-9bd5-0502d7c514e1",
        "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
        "indicator--e661c93f-98be-4d34-8e34-4c20f3f9e1f2",
        "indicator--c6d78f9e-948c-4514-a058-90a9f0dbc41e",
        "indicator--fa8f0d6c-eb96-4f50-8ebc-bcaf8271fd0a",
        "indicator--653977e4-4221-4e55-9ce5-a337fa97c5d6",
        "indicator--a73cf790-bfa3-422c-8487-75bbbfa8b027",
        "indicator--3e9090ce-d29d-4cb0-ab58-8e8a2d8d2fd6",
        "indicator--5ec78a7c-b309-4aec-a23c-835b6375d278",
        "indicator--e1f50bd0-89a7-46df-8a76-6e7b07e0af3a",
        "indicator--2ef6fb13-b474-438b-b19c-d689c381ef05",
        "indicator--3f554858-5eda-4f84-82d3-e170a9645f74",
        "indicator--2b0650eb-2606-4157-8118-5676e989b32f",
        "indicator--be49b12d-7133-4956-a884-653aaf73c7d6",
        "indicator--f6564a2d-ea4b-4053-8c2d-326f71e093a0",
        "indicator--c68bd87b-c41a-4dfe-b0d7-6731635a2a68",
        "indicator--0478d659-b405-4db0-8557-ac0f3076fc44",
        "indicator--a8019624-12ef-4b4c-b14a-53f6ba0a958c",
        "indicator--510e63d8-8cf0-45eb-9c18-4f91d885e962",
        "indicator--d0246f33-282a-4fa7-99c7-74937d9c1162",
        "indicator--5e9026ac-323e-4325-8685-c5d88079c34f",
        "indicator--7f80473c-6fd5-4c7e-b940-2de7c1725a72",
        "indicator--8e4019a6-d877-4d56-b0ea-4976f8c8194a",
        "indicator--23e596c0-3ff5-413e-a1df-eebc2dfc223d",
        "indicator--05b39e40-8647-444c-b926-b58e9c60adec",
        "indicator--12f366f5-3a5f-40af-8c66-3fcadbcc9e6e",
        "indicator--2505c337-3453-4988-bfd3-93161d78175d",
        "indicator--a1527cd0-6984-464f-8d4f-f06e265f7331",
        "indicator--46c98a12-87f6-4776-88b2-35cdf39e87c3",
        "indicator--74d926aa-a23a-4a55-ad0f-6f87cf8ee3d1",
        "indicator--f88975e6-069d-4eeb-b061-b05155ceb8eb",
        "indicator--91b4169c-b4d7-4b47-a7c8-38f54f1d3002",
        "indicator--c6a2955a-fe29-4d23-8331-c9d87b6ffd3a",
        "indicator--c43d9a26-9aa0-424e-9d5a-af9e4160d1a5",
        "indicator--8fabe323-8a1e-4141-917c-e17dbac50c08",
        "indicator--8427779d-1eb7-4899-ac6f-41789850362c",
        "indicator--6584f493-9567-4fe0-87fb-b290579cb8c4",
        "indicator--e75356bb-b84f-4162-94b4-c534814cf603",
        "indicator--a97d6d29-075f-4463-a2f9-6e804ea1602a",
        "indicator--c51e5bd6-8f85-48a3-ba80-13d07c64da90",
        "indicator--8ef6d3fa-2a97-4a60-92d6-d7e895b59b6d",
        "indicator--efe8887a-c482-4578-ab7f-25fda09467d4",
        "indicator--9e6c9324-d9e7-4ce3-8aac-74bb2044cdbb",
        "indicator--4cabb1a2-67ea-4bdc-9c84-09a4c552f09e",
        "indicator--10669b83-ec11-4068-af6b-bca494f21f50",
        "indicator--ed5039ae-0e06-42c0-89db-43079fa374b4",
        "indicator--7df524f7-ba52-4ea8-8553-3c0d01adec0a",
        "indicator--b88b2fd2-df33-4035-a7b6-0687894d8321",
        "indicator--9978f2b6-fb0a-486e-85af-2b01850cccb6",
        "indicator--1b1c8bd9-03ce-456d-a2c6-165551ed76bd",
        "indicator--dc2e98c8-4ebc-4b05-ac08-5ef8f4b7a96a",
        "indicator--25013dac-3b1d-4386-8509-345d0379c59b",
        "indicator--c5d1b75c-c5fb-4ce0-bf8c-bb398b64f1ad",
        "indicator--ed0e164b-88d1-4f60-b1ce-6586159123bf",
        "indicator--8772296a-bb9d-4053-90c7-94820e749fa5",
        "indicator--1e7a175c-35a2-466c-b520-27e7ef2abd0b",
        "indicator--f685ef7a-f831-4a0e-8a96-780498243687",
        "indicator--fec098b2-9289-440a-97f0-96709e4761c7",
        "indicator--e014213e-7d4c-4888-9042-925f5bcdadfb",
        "indicator--78cbc3a7-61e6-4de6-8afc-0772c1501502",
        "indicator--b3c53e8e-a30a-4ac2-9cec-331055fc67e5",
        "indicator--e27be004-fe95-4284-9a4d-ede51203f981",
        "indicator--91c8deea-b6d4-4b1c-a7c7-364ec9bf77fb",
        "indicator--e3634c5a-ee25-41f8-bab5-55e59f27989f",
        "indicator--e3feaaf8-7ec0-4370-b5d3-4938b6cc6a92",
        "indicator--37c94036-d5e7-489d-ae3c-ecb383d27ad6",
        "indicator--c2128113-a42f-4234-ad86-37ec244a7b6f",
        "indicator--25944b0a-9a3a-4e64-a7ae-aefadda84642",
        "indicator--e08f1aad-8f9f-4434-b8b7-498550279ab1",
        "indicator--c669fec0-c508-4937-845d-1b5b649b0b0c",
        "indicator--89f8d8f5-f5e4-4016-9d33-096f0b426109",
        "indicator--53c85515-5871-485a-a901-d644886149c8",
        "indicator--48399f67-39f7-452f-b32d-3496a3ae32f1",
        "indicator--0ad7cdcf-0ff1-43e0-8830-58019f0a058b",
        "indicator--e672c7a3-98da-4332-a0d2-62e04f6182dc",
        "indicator--7aa47f3d-4381-431f-a65c-4538790378db",
        "indicator--9224edb5-7da2-4760-b099-057b2662977d",
        "indicator--d9bfb1b2-7f8d-4248-9a1f-30ad93f28a7e",
        "indicator--38af5f3f-e8da-4d54-a512-3ece5ad10091",
        "indicator--4cb2584e-e632-40e7-a612-bb2c24ee15d8",
        "indicator--22b810bf-02ae-4eb8-8718-855f9b73752b",
        "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
        "indicator--69061a7f-fd0a-400f-a1c9-e15286119969",
        "indicator--46069435-804f-49b9-836d-aadc764b99f3",
        "indicator--f1cfe821-66d2-47cb-adbf-1b2b51dd2c29",
        "indicator--1340cd1c-d297-4d4a-9bad-8cd13201443d",
        "indicator--bd8d326f-eb42-4bf7-a560-d27a1e2bdb5d",
        "indicator--0e45b88e-1075-4263-81b7-228db1f86eb9",
        "indicator--ce47c7f7-d15f-4d5a-a44a-bd26697027b5",
        "indicator--f66f2dc1-4bee-48be-8681-9d77ac0b46af",
        "indicator--2ca4f43e-3073-4e1d-8be8-0c681555fabf",
        "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
        "indicator--9b89c09d-5cf6-403e-bcd6-3f41628f1121",
        "indicator--8dca1ef5-2c92-40f5-b884-47f453486b7e",
        "indicator--fbc5a974-e439-4ee8-9c6c-332f583af808",
        "indicator--4b2fef8d-b94c-4065-bcb4-84452dea657d",
        "indicator--74ca75ae-cda0-48d6-b320-3d0be366a4db",
        "indicator--06f41c72-fdcd-48df-be65-99a71a47e069",
        "indicator--844dbc9e-03b6-4e80-8f20-957bf9cad3d3",
        "indicator--773b9909-5423-40be-ae60-46789872ad76",
        "indicator--2faa8d29-2928-456e-a472-53084abcb47d",
        "indicator--2b0529d6-ba3e-466e-ae59-5c95a6c634ac",
        "indicator--f6b8ec71-3722-478a-bad5-c197209ca7b1",
        "indicator--e98a62cd-d565-4d69-a077-20a3b403af3d",
        "indicator--bdfed098-3063-4116-9841-19eb7779fd9e",
        "indicator--247df011-3986-49cc-9e3c-adcdebd2dd8e",
        "indicator--ea108cc2-7117-4bad-8676-1a649b7b7ffa",
        "indicator--0aa0b29e-c0f3-46ea-9aee-382efd49b419",
        "indicator--1f1b5bea-76b1-472a-8def-72ea35ca84ff",
        "indicator--b48bff72-45e4-460b-b663-744c0dcab0a6",
        "indicator--1acfdd36-493c-46d2-a8bb-34c40f48f335",
        "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
        "indicator--d49ec940-d5b9-44d5-a0d4-46a0ca11c4bb",
        "indicator--9e9948d6-afdf-41c4-840e-8385eed05713",
        "indicator--6d92cc0e-b57a-4f95-bea3-272904c3549b",
        "indicator--a6a2ec49-3a23-49c3-a214-99f7c14dccd5",
        "indicator--d6b29a40-eec8-4b80-a738-cd13e9abbcf2",
        "indicator--c7152a83-7e12-48ce-be12-97d72ab51699",
        "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
        "indicator--c2a8bb1f-5372-4f74-b968-feccd4fb49cd",
        "indicator--4a524640-61de-4ca3-b8de-0308c4fee872",
        "indicator--4efbda66-a53b-48ce-b006-b54d5d8c9ffe",
        "indicator--0022e6ee-e565-4a79-add6-23e76f6e42c3",
        "indicator--c181108b-cb0d-46ab-8323-ca3cc9bacfb1",
        "indicator--4a0d8161-720a-43c7-aceb-7509892f4a60",
        "indicator--efe6d02e-955d-440b-9a61-089b29503500",
        "indicator--3062bce4-4e21-4683-a3a8-62e12c88c89d",
        "indicator--c343e197-c3b8-45fe-8e53-ea3be6be1abf",
        "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
        "indicator--28e96550-62ac-4504-9992-b4fa47ffe81f",
        "indicator--57b406e4-fad6-4984-bae0-e94b2407d8b1",
        "indicator--1e50580d-74b2-48fe-b2a5-c730057f6e8f",
        "indicator--7f0e386d-9103-44ad-a17b-bdc0655d407f",
        "indicator--ca3bd0d9-70f5-4bea-b909-77c9e00db9d4",
        "indicator--04356b0d-5e50-457f-887e-2b2c069a2534",
        "indicator--58d6cfc9-cb81-44d5-a118-a12b220ec545",
        "indicator--d8148c42-b57e-434b-b432-934e8d080d61",
        "indicator--ec28ee9f-03d2-4c06-9a7e-82d05e381f1a",
        "indicator--353fe188-04d0-4a25-bda2-12ff9ad03727",
        "indicator--62bac296-0ed1-4216-93ab-fb04b8ce48ba",
        "indicator--9dd6c369-0412-4753-bccd-6141cec33fcf",
        "indicator--35cf17b6-7591-4e73-8d36-c399fcab1ff5",
        "indicator--e7322451-c918-4004-8336-c4e226102f5c",
        "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
        "indicator--d12c750a-71c8-4d6a-9147-1555a684425d",
        "indicator--fbedf4da-67d2-4184-97c7-937e4dfd5d04",
        "indicator--57e48985-d22c-45b1-a2c9-3480f2843e04",
        "indicator--d34e6b43-701b-4257-87e0-e81dd6d1aded",
        "indicator--dc7ec6fd-c5c1-4e32-bbc3-6ecc7bc34504",
        "indicator--4e54defc-eef2-493d-8335-7d224a45dfcd",
        "indicator--1dc8028e-25dd-40ee-ae78-f166ded2da26",
        "indicator--3ff647a7-1cab-4757-8139-a0a5bd18ab37",
        "indicator--7fee03b7-00c0-413f-b880-41c1dd79b07b",
        "indicator--c065d86c-e836-426a-8fda-24c16865b9a8",
        "indicator--8c18d1a9-d1b1-41fd-b805-6d4eb1ab3524",
        "indicator--8d65c3b1-0f14-496c-9a37-b8377847e88a",
        "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
        "indicator--21d35c78-2165-4507-a52c-e3b29c474e1c",
        "indicator--ffa1c1f6-9936-4dc2-9f96-180ca3300eaa",
        "indicator--e73b4dac-094b-4741-a790-1def04c45925",
        "indicator--0fbb174c-49b0-4fb5-bc00-563e89943b89",
        "indicator--be976e5c-7f61-4ed2-a6c0-110130d4cb95",
        "indicator--4fae6f48-0d4a-41b7-920a-967fd17a9429",
        "indicator--5f9fe9bf-7c93-4670-9b65-813ce1838c54",
        "indicator--0d72daf4-f05a-4133-9f36-97a82c91e335",
        "indicator--8e3acc7c-5d55-4655-8099-d49bd15f7809",
        "indicator--ebd643ab-9094-4065-a17e-9d2473b1fbf4",
        "indicator--4961bf5a-2a28-4ca2-8770-e6a3a0f53bc7",
        "indicator--69af1ab1-7a9f-4d42-b235-e2a7011fd13d",
        "indicator--bec7a5bc-054e-45c5-84f2-37b56d067bcb",
        "indicator--ebea11fd-2162-4626-b0e3-1afa2c76e292",
        "indicator--9fd87a23-fe6c-476d-8c14-0a87f56b3b08",
        "indicator--ba8707bb-e445-43bc-9ae2-a873ed19048b",
        "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
        "indicator--aa1593a3-4458-44c3-913d-2ee4f55dc37e",
        "indicator--541e2787-d111-40ba-8c57-4f436332ce96",
        "indicator--9376711f-9abd-42a5-a157-1b39e289f81b",
        "indicator--20c5b794-e21b-4c83-bf11-6cfc4003a78b",
        "indicator--66bf2a68-21fa-409d-9b8b-932eb9be1836",
        "indicator--34556fb6-5b8b-4d0e-a0b0-479155349980",
        "indicator--9896e034-7ce1-4292-8058-62673b5c1de7",
        "indicator--37273a95-8d2f-4b74-9c2e-4b5e03fc013f",
        "indicator--c5e27439-4d11-471a-a1bb-d82fe2f44054",
        "indicator--b4bb2b29-1d39-4093-a1cb-6989b00cfee6",
        "indicator--62412275-348a-4fc4-a201-bb544c3d67bd",
        "indicator--6a75b582-b2e2-4244-8a78-632ac030de77",
        "indicator--76f0bd23-9b7b-4f9b-93e6-e3a0069cc3cc",
        "indicator--02f53cfc-c487-4a9b-8bb3-20ce53f3e2f8",
        "indicator--690506b8-015e-4301-837a-1d64b378118f",
        "indicator--b45533cc-4a62-4042-b6d2-e4b794eef3e5",
        "indicator--a1f6708a-de77-4f0e-91a9-6f4ee0ccfba2",
        "indicator--2c8c024c-caad-40dc-b6a5-9f7ddd5072eb",
        "indicator--6a8c47c6-2450-4f5c-97ed-2e1cfd0f6a4d",
        "indicator--4805e460-34a0-4f5c-9f5a-5e598f0a77c6",
        "indicator--21b90e7c-5fe4-4a4d-8039-c88b82be7242",
        "indicator--63628dee-b668-401f-af4b-90470e0523ac",
        "indicator--53beb894-9f35-45a1-80ef-9ad8f4d67913",
        "indicator--cd858af1-4bba-41b6-9637-ad7d4d0decc5",
        "indicator--80586eda-69c8-488a-bee7-4bcf63953a23",
        "indicator--72209dae-5c1b-4757-87be-0e9c432dbec6",
        "indicator--d0e2f365-cef7-4804-b01f-c0892d684a06",
        "indicator--e9dac137-3539-42aa-a55b-a065002ddaf5",
        "indicator--d45cfbef-b7a4-4288-9ffe-7b064b78409d",
        "indicator--5ccfc3ea-8b68-4de8-93f4-550d9d1a829f",
        "indicator--57805935-3be8-47e0-9852-0f19a278099a",
        "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
        "indicator--5c8c2e56-5855-4ab0-8c8d-aa7a3e297300",
        "indicator--d96c08c3-02b1-4237-8437-82ea4c96ca5d",
        "indicator--9c4825e7-ec68-4e7b-8e02-0c623b0604d2",
        "indicator--1182a548-ef92-47bc-9f8a-c5e5d2334dfd",
        "indicator--876c22a9-ae1a-454b-ac7e-d486be504459",
        "indicator--f807793a-930e-4c09-a593-702cc9e51cb3",
        "indicator--46a665b1-a030-44dd-9f60-d8540eb02217",
        "indicator--5a7be381-7aae-42d6-b9d5-87719aefb0dc",
        "indicator--e59612e4-4d81-487f-ba34-f7e4c28d70f0",
        "indicator--15580792-4466-43f8-9d20-1ffeef0b21be",
        "indicator--ae314f14-4c50-48b8-a5f6-d37727da9f24",
        "indicator--b4889467-5f9d-4eb8-9cbd-4083bce3b516",
        "indicator--cba7192b-2893-43e2-ae7f-e75b47fff7bb",
        "indicator--eb7c4519-0d81-4600-9f54-7b66d38ee6b6",
        "indicator--ac243f18-d8c8-4420-bd07-9f81fdad94e0",
        "indicator--b0f47210-bad0-4cac-827c-83b5b72e0d3c",
        "indicator--f796eaaf-1668-4c74-9209-f1f634c03e69",
        "indicator--b3ab6d9b-4400-4afd-98ab-09c70bf29805",
        "indicator--335ba962-161f-4936-b422-1aa824bfc4cf",
        "indicator--514611aa-afb5-4ae9-a3ed-b77b2fbb8d00",
        "indicator--f44a7b0a-f104-4db6-93dc-485947819c3c",
        "indicator--93e45557-a3eb-4209-95a7-fee58cf12915",
        "indicator--2830d2cf-5453-4499-b2f6-9b6d1e497d4a",
        "indicator--bbd350f0-42d9-4e08-adff-c4d38f6d840c",
        "indicator--adb2849d-044e-4b02-a2e2-463e8a04ff76",
        "indicator--014dbceb-0796-450f-ad2f-fabfcba2fa5b",
        "indicator--071bd404-0a08-42c0-b003-4766576ad925",
        "indicator--cf3b2131-4186-4b57-9c65-8b390a80ab52",
        "indicator--7b79c99e-1187-40a6-9482-4e7e5301ffcd",
        "indicator--7dc7510d-49ea-48a6-b420-89d6e3bf67ea",
        "indicator--d2534d1a-1e80-45b9-a442-3c0ede5ea5ed",
        "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
        "indicator--017a83c0-dc50-4c0a-86ec-71ec39e91f3c",
        "indicator--3575ba12-1df4-4df1-8e7b-99b7c955a8e9",
        "indicator--8c82d9df-81a5-4cfc-a5cb-9cb15e6da3ca",
        "indicator--1fd12395-37fd-440e-a2ea-2dc42ef28c1d",
        "indicator--3b516cab-2e26-4cbb-9e2a-8d04af486b52",
        "indicator--5788cf66-5606-40e7-9c8b-ece2d0b6fa40",
        "indicator--f7ef3801-6f3b-4e0c-ae2b-e26c2014ab76",
        "indicator--f9cb1710-1f45-4826-9ceb-3084a144b14a",
        "indicator--6ee23d63-dbb5-480e-bef0-8e769b803fc7",
        "indicator--49f2cd5b-717a-40b7-ab54-9e8f0e9c71b4",
        "indicator--ab19ea38-fe00-4695-b188-464d8c549de2",
        "indicator--51992178-a27d-423b-b158-43b2523c2ef7",
        "indicator--ea69a55c-14eb-4b1b-9e5d-043118053685",
        "indicator--a15ddb79-8076-4ef1-a466-9566c5c1ed33",
        "indicator--e7585f3b-481b-40f1-b7ed-5a1339310566",
        "indicator--07dd7737-5879-437f-9736-e24c5caac902",
        "indicator--619596ad-90bd-4c6d-bec0-26c36b149600",
        "indicator--0c8c78f8-1366-49b3-afb8-9b9ea828c812",
        "indicator--596faded-7d2f-4394-801e-0b5c73f7cf1c",
        "indicator--ab853692-afa9-4c86-b3fd-872b2c502242",
        "indicator--ee41e4a6-1dc1-4406-8c24-ce82868b5519",
        "indicator--301c3910-35ed-44d8-9ffc-d3e4b474786a",
        "indicator--b6d760a5-044e-465d-b2cd-4a2f943a4ec9",
        "indicator--37b64430-db23-48fb-8a22-ce2f643987d0",
        "indicator--919c4086-5229-47db-9718-03b64de5a415",
        "indicator--46d5bb7e-0bf8-428d-ab5a-cf0107785884",
        "indicator--8ab17f56-7943-477a-9dd4-9c8eeeb13215",
        "indicator--dd70e6b9-c2ff-477f-a61b-23c29a0e5437",
        "indicator--769a7aa1-bd19-43f6-b625-b9bcbdf620b1",
        "indicator--780c6de9-1122-4245-b2e9-e087c6ec5cee",
        "indicator--f0e23e93-2176-451b-b490-9fca4142dedc",
        "indicator--a758e1fb-4a22-4476-8e89-0e252e3d1fee",
        "indicator--ecb8440e-2c04-4b08-be00-690d1d1bb70f",
        "indicator--26d45a28-472e-4154-ba19-0bb7bca5e200",
        "indicator--77b7d4cc-81ce-4fbe-b53d-b369a0129c0f",
        "indicator--27c09052-0927-4e4d-bc12-c22c8e9f342f",
        "indicator--2a47c092-e4bd-48c2-b465-ad69198a591e",
        "indicator--9a425042-8470-4206-b4f4-ec72444e7171",
        "indicator--6ae25f71-9394-4118-95a7-a544da2ff177",
        "indicator--a353b6e6-a270-403c-8038-19691228558f",
        "indicator--084c83a3-ecb5-44c4-b7ca-acb04b55c985",
        "indicator--304176f8-6b5b-444e-a0b8-310675ac7cd7",
        "indicator--a6db1afa-5a9e-4269-a904-da8702622578",
        "indicator--fbe7af04-7de7-41ab-9a3c-78898d66541e",
        "indicator--47d64a1d-f3b2-46a9-ab40-4b9e44355883",
        "indicator--9cec436d-fc4f-42d0-9056-da457428ba32",
        "indicator--f49d2321-383d-4103-9526-e5d67cca98cf",
        "indicator--710d3021-1f80-437f-8197-e3423ac84505",
        "indicator--c69f73ed-6f96-4df7-b6a3-8b8e996f9777",
        "indicator--dda0682e-d213-4c3d-8536-2d5ef0639123",
        "indicator--1a8b5c35-5da4-40d9-ba6e-3363ac45eba1",
        "indicator--79c7fc87-e5c2-466a-9f90-280677f838b3",
        "indicator--5648d4b4-302d-4768-9585-bf6a479718fd",
        "indicator--2dd6a1f3-39cb-422c-82df-be4da0ac84f3",
        "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
        "indicator--6fd3f78b-1890-471f-b27e-91af0d2e57ef",
        "indicator--e0a80653-9b0a-4d14-b395-985f7ccbe7e0",
        "indicator--e2bb6232-8fad-433d-9c7c-be8e6fbe51a8",
        "indicator--1bcb2efb-b1dc-474d-aca0-9630725ab139",
        "indicator--8e40d7b2-206c-46e0-9c18-6cc2c52475ea",
        "indicator--ade40c08-7cb2-4f26-b203-2f14227aab91",
        "indicator--729776f5-e6b4-48a2-bc1a-3d868bbd8b97",
        "indicator--b41b308a-f036-4b40-82e9-867adb345a93",
        "indicator--cec97e65-8ece-4c2b-8fd3-1028851bb0e0",
        "indicator--e2bdf1d1-eb2f-4797-85db-85184da21d5e",
        "indicator--a6f243b8-5fa6-42da-a925-745accf29338",
        "indicator--fdfc4e9d-3ba2-4083-ba88-6942a2d595c3",
        "indicator--195682d3-107e-4623-b36b-e8563c55e067",
        "indicator--79bdc375-c50b-4772-be0a-96ea975b921c",
        "indicator--a499dae7-987e-4a69-9b13-7d1add57633d",
        "indicator--c431e09c-856b-4b31-9c49-312e655b91be",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--57f63c60-23a9-4af9-9270-879b1d647e0e",
        "indicator--d6a8cac0-d0a9-472f-890b-bc053626a7ec",
        "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
        "indicator--fbd1469f-271a-4e9b-abce-eb1ee752e443",
        "indicator--08983151-4897-427f-8312-fba9e060fc72",
        "indicator--ba8af91e-71bb-4762-b4b1-bcde2f80f991",
        "indicator--9928991f-8341-4bdd-bc54-8ec89550fdc4",
        "indicator--6c88d86b-983d-4eb1-96e1-b18ee893a82b",
        "indicator--1ca6c230-8f42-4a7c-aff9-5615f053a4a6",
        "indicator--7be7aaeb-4953-478a-896f-c6f6e0059c9c",
        "indicator--4a16580f-1cd8-4b29-ac2c-c385f827e070",
        "indicator--0eddf65e-6b98-471f-b1e4-9b408a525976",
        "indicator--3d66c89d-e9ca-4b77-a3fb-262d1a281655",
        "indicator--46390b48-03b7-4ea9-b7c0-a1f083813c64",
        "indicator--b2d7d513-ac8b-4bd5-b0b9-4a513621c676",
        "indicator--4bc8d169-46e7-46a0-bd94-ab17e9a24b90",
        "indicator--c258f1b3-57f6-4e31-af2e-85f71c17308c",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--997066cf-8fb7-469d-bceb-d006ef36560a",
        "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
        "indicator--05077b0f-4178-4db5-88d4-7eba40036c45",
        "indicator--4d74e957-d5af-401e-9589-4e3cf2a769a9",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--3d9fb7bb-5599-4791-aa4f-650a62ecf135",
        "indicator--af2a217a-6ab0-4943-a3c3-0fae304166ca",
        "indicator--6d56fbf5-0659-4832-8ef6-de5b1503429f",
        "indicator--ba5b6bc2-0c71-4a49-b220-6f714099056f",
        "indicator--c31517a5-a0cd-4aff-905b-71e549da0f53",
        "indicator--c4caa96b-87d8-4b9c-98ca-cd7b29781769",
        "indicator--429e2ab3-5f74-4ea2-9c4f-2f74ef04f213",
        "indicator--f9c6c815-4af4-4134-ba84-82b2a24be8a9",
        "indicator--b5e0edc4-364b-460a-99d6-cc876c6ea9f4",
        "indicator--3e91adc7-687e-465c-91a8-6db485dc50a1",
        "indicator--f6a3549c-2c4b-4e2e-9942-ab4c1fe97d48",
        "indicator--e80e0a87-bf75-4bec-8fb7-c97a864714bf",
        "indicator--e89449ce-fc89-41a2-87c1-2b72c3da6108",
        "indicator--4bf89e7d-ef13-4631-ae87-bda881bff5f2",
        "indicator--1d508daa-099c-4e06-a759-c85a7a10e41a",
        "indicator--121d0245-166e-4cb2-a9e8-8913d92a9a90",
        "indicator--8a914fe4-48a1-4b81-9285-d612ea3f5d76",
        "indicator--8299bb53-ce42-47c9-a711-e9fcf35acd21",
        "indicator--4b1ffed0-6b77-4b9f-bc56-1b3fd6d099aa",
        "indicator--afe41872-6679-4a6a-80cc-4076e199e492",
        "indicator--e47095de-8265-4d3e-bb45-1050dd2fd095",
        "indicator--43dcf991-0216-485d-b1c0-fe3a6892f966",
        "indicator--436995d2-f9ec-408c-96a3-a689ae1bac59",
        "indicator--30117e76-1062-47b0-89e2-872007bb9951",
        "indicator--134ceb22-0e18-4e57-8f09-9c6792f33031",
        "indicator--ec11fec5-b6f4-4b40-a8ee-0082f09399a9",
        "indicator--18dcc17c-713e-4f22-b93a-37d4abd88ee8",
        "indicator--611559d7-3720-43c9-8b52-9cd4c6f0e976",
        "indicator--f5dc3b03-d4e9-4f6e-9440-262d9e280b2b",
        "indicator--7b36a8cb-90e0-414c-af4f-15a6f84d9935",
        "indicator--73dc8510-a202-411e-8e44-1c3bdb00fb78",
        "indicator--58abbaeb-5104-41fa-a1e0-8447ef6b0fd0",
        "indicator--3c895926-bd06-4965-b357-2a4c75b72441",
        "indicator--f2a39d85-b2c5-4e05-81ef-cd028d67959b",
        "indicator--b1fc771b-2474-4e27-8ee6-8971f216bce1",
        "indicator--fa251aaf-ac6b-4fc8-a0e0-14afe4021617",
        "indicator--626ac04a-a1d7-4f0c-9e4a-72af6f722cae",
        "indicator--ecdf515d-a3f5-4dce-93b4-82f8937a01c8",
        "indicator--6cdc1504-529c-4ace-b626-6e431a377a32",
        "indicator--520b6b72-8dde-4368-a297-99e77279b408",
        "indicator--f35b5b34-4314-4cc7-826c-06c9bfd8df5f",
        "indicator--d09a28c7-e212-4a93-89e0-3cf11ed0d856",
        "indicator--46db8633-34a9-4b11-9ee4-2e5c1ac55cb9",
        "indicator--c323b4ea-6f50-4b8e-aaac-eb1384cd8862",
        "indicator--6b159607-f629-4c32-aa4e-1ba968a950ea",
        "indicator--f2425490-8f27-446c-972f-2ef9642685de",
        "indicator--7dbf7f09-5da7-4326-8cfa-187c74148f3d",
        "indicator--835efc11-c07a-4ca4-a78d-992b454e55b5",
        "indicator--0bc85eec-9f23-485e-a392-6b0fe96e0652",
        "indicator--2ccd88bf-d342-4f8e-b8ff-e0b1f766f1ac",
        "indicator--639054b0-6311-4972-99ba-58cddde6697f",
        "indicator--6578d392-6e60-43ec-bcc4-e6997287bdd6",
        "indicator--ec5180c6-cbe2-474d-a771-ed1840a91cbc",
        "indicator--109bdf3a-66d8-4fd9-8ed9-e403948e37c1",
        "indicator--83657cae-b47a-4dac-a9cf-438f10d30e58",
        "indicator--ad8f4715-2a79-4c0e-90f8-59a877f97022",
        "indicator--c0f6fadd-94aa-4976-9a28-092669d5db4b",
        "indicator--164e8045-ccc3-4acf-8fb4-877d9b4c069a",
        "indicator--f2eba859-9861-4111-90e0-203cb0e9d434",
        "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
        "indicator--bf82920b-8b82-43ac-9d9a-6b23ba790a25",
        "indicator--eda8f56c-2e9f-4ea1-a7de-2515c795520e",
        "indicator--b212f231-6004-4ce0-9b16-4cfe1ad9f0df",
        "indicator--e881cbcc-2c07-4a67-a7e3-eff691be39f4",
        "indicator--01bec2a0-4b23-4811-90b1-88fb84d594b3",
        "indicator--dd5ea02b-7be1-4c38-8afe-f4b05a28caf2",
        "indicator--9a5ca433-7b46-4934-9718-ad3081343e5e",
        "indicator--a92de739-157a-408c-bde3-f765932b0025",
        "indicator--bf7520aa-a1ea-4dfe-92aa-be0eb5caf6d1",
        "indicator--e15e1aef-1c2f-4b6d-bd58-74774ee186a4",
        "indicator--81757e06-d61d-4977-9fcf-2008dfb417a0",
        "indicator--2488109a-a549-45e3-b1fb-8dd69a325d1d",
        "indicator--d85fc885-c7e7-4d3b-ad40-ec40a7aa1d2f",
        "indicator--df776ede-e287-4408-ad8c-6a064c63244e",
        "indicator--88f64569-a5f7-4798-9c37-4a0f360015c0",
        "indicator--1c37b94b-2853-431d-81d0-f5bb9ed6edb4",
        "indicator--0a18f7d6-6f49-49a3-9b97-bd9e253f0c40",
        "indicator--f82c2209-539e-42a3-8cda-0f82bbc3ce94",
        "indicator--98c85f96-9b85-4949-9512-9681dd2b382a",
        "indicator--7e77a6eb-39ca-4d97-9074-1e4bb60a2b16",
        "indicator--345e6bb4-69ea-4378-b515-d4910e5de687",
        "indicator--b801ae31-3c56-4b8e-9580-fe4ea1891e78",
        "indicator--ebd3b035-3ae3-4766-bd26-224873c18378",
        "indicator--9d8e6494-cf67-400d-94c3-7b2f338f783e",
        "indicator--47d77735-09ea-45fe-8f22-912e64f66943",
        "indicator--de509441-f9a8-42cf-a9f7-827436dc94b5",
        "indicator--0b2c4ce9-fd46-4af7-83c3-a9599ea8f0dd",
        "indicator--d4acf898-a29f-468e-be7a-8b7d56d335df",
        "indicator--6ea4cdd6-a3b2-46fa-b1ba-7420cab7607e",
        "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
        "indicator--f2737a3f-0b49-4028-b557-b1aae9d5519d",
        "indicator--694e5726-f924-4d5a-a7e1-840e71ec06f3",
        "indicator--13fbfa60-3ebb-484d-b955-30d8d787f131",
        "indicator--0214c346-cdbe-45fc-bbf8-61c79dc01457",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--3d6385ff-8aa2-4d2a-980c-d7e9fb6d08fa",
        "indicator--f124d58f-06b1-457d-9baa-c4e949fdd2ff",
        "indicator--6744e9cd-8dae-45b3-86cb-e9d6eae0435f",
        "indicator--731bdb5c-9b99-4fa8-a378-73d7cd721c84",
        "indicator--df51a2e0-ebed-4e0e-82d0-aa9f82a085f1",
        "indicator--e894da66-c564-4dbd-8191-67174a6b9f6e",
        "indicator--bf81d47e-fbf7-4d71-80c5-972d2981ddae",
        "indicator--af3eae22-4d9b-4e0f-8764-67cf5c4243fa",
        "indicator--07d7a2ca-0ab6-4cad-8b8f-a06d00fc1420",
        "indicator--628f7581-c14b-4d14-98ee-cd2778d37e9a",
        "indicator--0bb73a4f-8d71-4b58-b3d1-da36de3e0cae",
        "indicator--fd2912a7-9c61-4594-92fd-00ccb6858c44",
        "indicator--091df05f-275f-4dfa-99ef-5c8416ac20cf",
        "indicator--7dad1dbc-3f51-46b7-aca1-c6945f7bf0b8",
        "indicator--591a72ee-dd51-4934-9ce5-4a09617d203c",
        "indicator--84d50f47-1248-41b8-a4ca-0b48b1402f61",
        "indicator--a7578eff-b769-48a0-9480-e1f2f1a5e2ce",
        "indicator--8e0b10a0-b17c-4b02-9417-118d13dd29c7",
        "indicator--d7d1ccc4-b7a2-43fd-8c57-501e2788660e",
        "indicator--6b71fe42-6c43-40f4-ba23-b869f067abcc",
        "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
        "indicator--4a59ff72-6136-4bb1-9161-a8d6de81b1a2",
        "indicator--32bc6504-e846-4216-ae19-f9478e19c059",
        "indicator--17e61173-085e-46be-89e2-5331da55b4ee",
        "indicator--1dfa7362-a503-4425-bd55-5e27cb91c17a",
        "indicator--958e6ec7-b30b-4ac7-973c-dd43141f13a9",
        "indicator--f8641fb7-9131-45f2-a8f1-46c70a964323",
        "indicator--bd3cc4c4-c4d9-4b63-9621-29046a1339df",
        "indicator--18b4d64b-c946-418c-bae9-a102d25119cc",
        "indicator--11437c3d-5c27-47f2-bf19-40266364f3d8",
        "indicator--c44b5963-ce09-4534-ab5e-d1aa3308c88a",
        "indicator--9c7787c5-cd7c-40ae-a96b-850cc9392d3a",
        "indicator--f6a6be55-9cad-4fa8-b24c-097172ff2bfd",
        "indicator--22d6e4b8-565a-4b96-9d65-39d02822e395",
        "indicator--ed87fd99-80b7-4e6c-bc84-6f6ad16e494c",
        "indicator--20da7bb5-6118-4c64-8fc7-bb3a9638ec31",
        "indicator--5fe5535c-49ed-4a05-a297-58debb5f8d26",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--28d65b6d-52b8-4d3e-b92e-f01f5cac77d2",
        "indicator--beb7e1f8-b4f0-4b68-94c6-5cae7123a928",
        "indicator--57afc9e5-ca15-4bf4-ba65-9bbddc1126e6",
        "indicator--38897cab-b34f-4acc-810a-988adea5a5d5",
        "indicator--97bbeee5-229f-467a-8afe-d703b2e8258b",
        "indicator--e0e0d1b5-230d-4942-b5d4-926db364d37b",
        "indicator--16e28421-c0c9-49d2-964f-b37478957381",
        "indicator--f71ad4ff-6896-48dd-ae1d-d663f2d2f853",
        "indicator--817c332f-b582-4916-8bd7-c9dd5aca62a2",
        "indicator--34cb6591-07fc-4ccb-b0f7-fc38eb12e825",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--308f03bc-fcc5-45ac-a39a-d3c91b2764ca",
        "indicator--4ba2c850-6ffc-4022-aada-3e1846e3d2e1",
        "indicator--631d9f15-2d8f-46ed-8539-dfb7fcb3c6c6",
        "indicator--5bb3d259-3679-4f9a-a13f-973d6e189560",
        "indicator--397a401f-c34c-490d-a02e-5c18e8a216de",
        "indicator--46ebe052-bb50-4d55-946c-d84c477dbed4",
        "indicator--5ce549fe-625e-478c-9554-cf1ccf2015d4",
        "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
        "indicator--782f7401-c315-43e5-9f36-976f937d4f26",
        "indicator--6c813860-3190-4754-b418-726b1e3f3105",
        "indicator--7c385c4a-6947-4d79-9a5e-a3ed2c3602f5",
        "indicator--e30caab0-4961-4134-9c0f-e99ec3591a7e",
        "indicator--b7f73a82-b59b-47d9-87a0-28f46c100566",
        "indicator--8590d888-1725-443d-918a-b6b6d19da184",
        "indicator--d04ad77c-20a9-44d3-a16e-2847253bfc08",
        "indicator--ad80d2f6-17cc-4e44-9db9-1774d1e04081",
        "indicator--bf55c224-7c18-4627-9bed-010168164dae",
        "indicator--2546d73d-5994-4ca4-a1fc-306e05fc0afb",
        "indicator--9d081eb8-22df-440f-a001-f98334673863",
        "indicator--068dc4f0-830b-43b1-899c-f5fcca2027ce",
        "indicator--30234411-49f0-4b2a-96d7-2ef57efccaeb",
        "indicator--9df07f32-2eb4-4603-9865-4aeb9019f5be",
        "indicator--81b653c1-112e-44fc-aa99-dc33e260595a",
        "indicator--2ad998bb-c093-45ce-b393-78fbd0033027",
        "indicator--d5364081-3480-4139-9894-855b8073df55",
        "indicator--7f20472e-38e7-41ac-8153-af9865525616",
        "indicator--292a3d12-17dd-4f99-bcb2-034753eaa483",
        "indicator--07452f82-e8b1-4b3f-b8b5-d3eb5c7f9484",
        "indicator--69b3f1a3-ba46-40e7-b546-70100224fd0a",
        "indicator--a8b7feef-c3ca-4aa5-a195-7bab96abd00e",
        "indicator--0f2164f7-802d-41a8-a11d-df8956a6dd21",
        "indicator--9b1b4e6f-67ca-41da-92b5-bcf209bd6ce7",
        "indicator--2d38ddbb-02c5-4285-a139-1fc91253bd03",
        "indicator--3804c1aa-4ad0-4c2d-b2bf-0089f588bd07",
        "indicator--46d0c2df-0638-44f1-b05a-8e2b4a38d82c",
        "indicator--6a8518b0-8f4b-4f47-8395-0c33e93d11b5",
        "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
        "indicator--1b9c1021-dff6-4f07-96f1-4485d6cc22ab",
        "indicator--82d2c8c8-df14-4e1f-a9c8-0795b0fafad9",
        "indicator--e96118ce-0df1-44df-a9fa-07a791085fe2",
        "indicator--5536539e-c6e5-4ee8-a140-fc0a4bf1ec67",
        "indicator--a0eb5dea-5699-4c29-8841-5eb8fa1a3b8a",
        "indicator--ef510344-b93d-4e30-a916-2a0370a58560",
        "indicator--f6d3ff96-feec-40f7-b58e-c724cc00bac5",
        "indicator--8c03b35d-128f-48a3-affb-f000c4bf982a",
        "indicator--5bb49337-f800-44bb-8415-adaeb1bbea16",
        "indicator--9a739eb7-f862-4cad-9abd-ca06832485d1",
        "indicator--995e9481-2cbd-4aee-bf90-75513bc20311",
        "indicator--691a87fa-6c8d-443d-9354-4bfc0b69398e",
        "indicator--7fa03b88-b8ed-49a7-a39c-0dc7ca6d7a4c",
        "indicator--cd465a82-dbc5-4588-9eab-2fabe61243c3",
        "indicator--31be608e-fadd-425a-836e-e1a2950d50be",
        "indicator--d86b4e83-d8de-4c13-8dfb-fdb5ed4372d5",
        "indicator--32a613c4-e263-4390-a7d9-15871cf4a6ac",
        "indicator--67064104-ff20-40d6-b9da-86c890cd468f",
        "indicator--d4628c89-3921-4c90-a998-a5018585f8ca",
        "indicator--d0405b62-cd26-4aa4-836c-0e58d6675073",
        "indicator--02a2b7e3-9f6a-4916-a100-56936b4f7dc2",
        "indicator--c3f121be-a9de-4b53-a70b-146cba2e270b",
        "indicator--e810d45d-ec54-4e69-864f-66fd609b53d4",
        "indicator--cf9dbb9d-764c-4c9c-bb9c-975b40fd7c36",
        "indicator--00eabd39-b3e5-4f2a-bb49-946fb5f53489",
        "indicator--61a40e57-20cd-46a5-b550-c45c66a13fe4",
        "indicator--dd8df2d5-77b2-44db-be8d-d754bd3c1cf6",
        "indicator--38742172-02ee-4d51-9f5d-7f25d3079bb9",
        "indicator--ec1433e7-9fab-4d53-a0c5-e3e3479aaac8",
        "indicator--d65ac846-103b-4849-aab1-1898e1a2dd29",
        "indicator--d3440b89-2fc6-4d1a-b43f-2acac6bc6cdf",
        "indicator--33a68fa6-e9de-4e25-971b-48e547f32d57",
        "indicator--73f02eed-936c-4b33-9003-565e81209be0",
        "indicator--02885978-a19c-4db6-98a1-0f157b114e37",
        "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
        "indicator--ba2d8d3d-7045-4c35-8d1d-a1110afe1413",
        "indicator--1a457d21-c7a7-4b5a-b0b2-8b3d2fa34ad6",
        "indicator--063695f1-576e-47b7-924a-f5860917274d",
        "indicator--77172c58-0b3b-4310-8b4b-27b813ea969b",
        "indicator--7ac7253e-6ced-4aa4-b514-f3817614193d",
        "indicator--101fb7d8-7726-41b3-b694-45f6d7039b2d",
        "indicator--a7042379-fad4-40e0-8b2d-14f9ca645e9e",
        "indicator--7e9ed786-ffd8-41fd-9e1d-0a415a99a4f7",
        "indicator--e63b0269-c525-4bdc-acc6-b9ee1f695482",
        "indicator--d597cf65-3447-4da6-8186-9e565625a921",
        "indicator--8eab0045-65d0-4e32-aa3b-59050f18d76a",
        "indicator--75837af7-5bff-4e97-8141-198d8bf54273",
        "indicator--bb735259-c370-4064-8160-d91a35b839ac",
        "indicator--11b1a56a-bc98-4713-abda-0f0c97bb12d9",
        "indicator--7829dfb7-c2d6-4741-830a-5882ac8ee255",
        "indicator--16751b38-c3d1-4cfb-b291-eab50e1caad7",
        "indicator--11f08629-7428-4caa-95cf-5258a03d9ecb",
        "indicator--fff54572-ac0e-4b91-b956-f7dddeb53bdd",
        "indicator--9e043ed7-ece8-4223-a7e0-56a839560257",
        "indicator--059dec12-b8d4-4cdf-9c8a-f32608c6f39b",
        "indicator--bf3325ca-7b42-49e2-8d16-e0ef87f5f4c0",
        "indicator--ed98c081-4298-4250-a884-6e8b38e2e30e",
        "indicator--c618bb53-fd2b-45a0-8c81-63e0c33c31b6",
        "indicator--0d1f328c-6d31-4eae-97fc-3c0190c46f17",
        "indicator--bc4d3ad2-7ffa-4b77-863c-5b88a44320f1",
        "indicator--584f4730-63cb-4a6a-ade4-9be9fd2cea63",
        "indicator--b5fed883-c7e1-4b88-978c-ef494955bd37",
        "indicator--bde3a1b7-251c-487a-b023-6c4d3627c6da",
        "indicator--b7c7911c-39fd-4903-981d-0e2c31507004",
        "indicator--9a85b5c3-fc9e-4c55-923d-98905d4e8ae3",
        "indicator--ee9c2970-e7c4-45b7-a029-65971558d588",
        "indicator--1dcd3ae5-a148-4896-868c-d0a9321f4c58",
        "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
        "indicator--9fd0b0c3-013d-441f-8aa8-4d689652e903",
        "indicator--318f6c56-7c57-4445-b287-423becdd160c",
        "indicator--9bc34f70-07b5-48d4-8a74-fb0e190086b2",
        "indicator--2a77a765-07ca-442d-903c-bd358662095f",
        "indicator--beb9b60b-b7e7-4bee-9544-a8e750172457",
        "indicator--fc9fae7c-bfdd-4839-988a-34e1b546c5c0",
        "indicator--225883ea-fda8-45bf-8d29-f1a2cb6cce34",
        "indicator--91becaff-ab00-4031-964e-d38cfb9f9982",
        "indicator--67a8968b-4ed0-4a4f-9eb6-915da2b643a3",
        "indicator--60e5fd34-8bc7-45e6-8d2f-b94974fe5014",
        "indicator--43941c94-da44-4c70-812c-efb39ffc9cf2",
        "indicator--92c1ebb7-43b7-42de-89ca-c917542dfc9d",
        "indicator--5bc3854d-0616-4950-91a1-039bacb5dbee",
        "indicator--03b98991-e9bf-4f35-8db0-acbe8f310415",
        "indicator--5a76e15a-f83d-40f0-adb5-e111a28a70d7",
        "indicator--1441cfc8-b2b2-4263-b21a-d28c41d0a370",
        "indicator--5466d5d2-2bbe-4e22-8edc-7491415401be",
        "indicator--7940b703-222b-4d55-ad81-96acbdb0e0c6",
        "indicator--875e45b0-22f0-408f-b091-8c637250f6c0",
        "indicator--e01bf0a0-40ee-4b47-a034-c868c193d839",
        "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
        "indicator--76a55ed7-daf1-403e-8ca6-85d673afcea3",
        "indicator--528004a4-5a9a-4c05-9ecc-4aac8524688a",
        "indicator--347f7b08-e064-472a-98a3-3e9d8f52184b",
        "indicator--67af446b-7d40-4330-975b-c57fbc91cbb0",
        "indicator--0b7284de-8e59-4ad8-b884-8d0d7dbd3984",
        "indicator--4ed2d688-829b-4b9a-a48f-c87f8a37288f",
        "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
        "indicator--8f139568-043f-467a-9db4-5393a0d89ac7",
        "indicator--28663b88-a35e-4d3f-893c-74bf13fd7db6",
        "indicator--bb1a7c72-6f5e-486b-ab29-5796437943f5",
        "indicator--36684f27-5014-475f-9a60-c2714dd9a293",
        "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
        "indicator--38453f77-9097-4aad-a13f-77a21c90d2ab",
        "indicator--a1591137-cfce-431a-b46b-081dc692ebed",
        "indicator--abd5bafb-907e-4ba1-a735-87382409d859",
        "indicator--261da30c-84e0-4f21-ab04-7d2871921778",
        "indicator--924bdbae-1d7d-494a-aa17-8344a23a21a4",
        "indicator--935e0c9d-0310-4b40-ae25-5803cc51eec8",
        "indicator--9fd8f06f-67cc-4716-b52f-336ebdf02e4c",
        "indicator--e85c0555-33ad-4150-9ec9-e907381d5f8d",
        "indicator--a9e5e3b0-c34d-41e7-b371-04e4ed392364",
        "indicator--ec6c7bf4-5bd8-43e6-a54c-779c3f253e7c",
        "indicator--48b202cd-b086-4b5c-b007-6fdd47f8a04b",
        "indicator--ac5e5c14-2203-4846-bff0-a995f20a6ef2",
        "indicator--63305f82-6c9a-4830-8809-6b93b5a00040",
        "indicator--12b35dbf-f483-41b2-ab31-905e8d2c9301",
        "indicator--63cace11-3dda-4779-8064-54c7a9b5e4cf",
        "indicator--df6e6259-97aa-4bad-90d6-d86eb52678a3",
        "indicator--998b0abe-b8c1-469b-9219-31660577fd51",
        "indicator--41c02dca-df06-4ab4-ac6e-158ef48c106e",
        "indicator--9b269b4d-505f-4b9c-ba77-87210944a83a",
        "indicator--27c46f66-0daf-4bb4-97a4-30c712f135df",
        "indicator--f1d1428e-be5b-4085-bb3a-d6ff03d541fe",
        "indicator--7446f4d0-3b9b-47e1-ac90-06580f66b94e",
        "indicator--5596db70-4170-44a4-b5a2-cb700a8fd58e",
        "indicator--91ae114b-8ca1-4a7c-85b3-3bb9e1e0efc0",
        "indicator--4df41694-8d21-4e0b-ad42-124ad3afbe51",
        "indicator--ea0aa770-7ceb-4b6e-a8b3-7aa327b5d535",
        "indicator--0782cce2-d3c0-44bd-938d-61194db44dec",
        "indicator--ff6fa2a7-4e70-4532-89e1-4b079a4bf312",
        "indicator--2dcf690f-c07c-4049-8272-14c1abc3faac",
        "indicator--53738dc8-392e-4791-8a33-b4be7ca66287",
        "indicator--b4264b74-6c89-4f68-a3cc-25a8cc05e8c5",
        "indicator--35cb66a4-6c0c-4fa5-b0a6-ce6a9da24934",
        "indicator--833488fd-1719-4226-8e0b-b798d56ed3d4",
        "indicator--6b8a0cf0-7dc3-4d29-bae7-8de7e2f2359a",
        "indicator--dbfad94a-77f8-42c9-a75d-dd4f69c9e456",
        "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
        "indicator--95e97da2-809e-404b-b696-1ff96d10e187",
        "indicator--7a58701d-c68e-4e7d-82b0-ea2b3c437405",
        "indicator--5d82164b-9dc4-4a75-aafc-503c4e395f38",
        "indicator--b317e924-3658-4ebf-9ef5-2b148be6877d",
        "indicator--25482ed0-621e-4a0b-84c2-6c1f725a38a7",
        "indicator--39c580b9-69aa-48ff-91df-59a59ded9c97",
        "indicator--6576bf41-20a4-43ae-ab2a-5839f475604e",
        "indicator--e8f05d98-4a19-4794-8dda-68a840205e21",
        "indicator--a603e17b-853f-4b87-bcda-2de8aba8b136",
        "indicator--6e8c6f52-80f7-4dca-b513-1b366ebbb693",
        "indicator--aecb6bbc-a025-4126-abc1-bd23ec5d413c",
        "indicator--3c4b993c-52a5-42c6-bf90-6615408dd724",
        "indicator--6ad90062-bb88-4500-b96f-49049bff1c81",
        "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
        "indicator--e780b59e-5f36-4d24-83ae-4c4eb5394a19",
        "indicator--bfa2054f-7f37-4bb9-8875-9055915b4bd9",
        "indicator--ec6badc9-7bce-4343-9f3a-11fb8c98f044",
        "indicator--24722609-a55f-450d-896a-433d46aaac48",
        "indicator--36820bcc-30f6-4b74-b090-a282e5991ab6",
        "indicator--a75398c8-7633-4790-9bb0-6092a28549a3",
        "indicator--b9d320f4-05e4-45c9-8ead-de19d22078a1",
        "indicator--2ca5b9e0-40f4-49ab-9de2-fd75a6ab6e1e",
        "indicator--4dfa467e-9418-4c1f-ac63-da95aa57ebfb",
        "indicator--782330f8-51ee-4781-ae77-9bfbfe4b4a26",
        "indicator--d68108dc-adeb-4f2d-adda-bc453d0e0610",
        "indicator--e8767e57-4144-43c2-85ef-b4829e839ae1",
        "indicator--d90fd648-515b-4e16-9061-85bc79d80ba8",
        "indicator--9965f437-9ce0-4393-bbcb-9cdefc28871e",
        "indicator--8cf0fd26-299a-4c32-9962-3731317b16c1",
        "indicator--a30ff4a5-8b6c-4c06-936f-4a15bd21c048",
        "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
        "indicator--a0bda11d-e696-448c-91a8-8850613727ec",
        "indicator--531d3558-bef3-4f5f-94e7-2eb6d470b712",
        "indicator--53a952de-ac0b-4db1-b3ec-2ba32ad8d990",
        "indicator--abf0b2de-4276-4acb-8fcd-76b0d3db58de",
        "indicator--02998fda-b105-4ec9-acb0-ac3481d4d899",
        "indicator--13fcf746-7b54-49b3-abda-71c6218439f9",
        "indicator--2ffa8a87-ae98-40bc-9db8-0ae66804db01",
        "indicator--d7bedb92-5545-45b7-a66d-5058d2bc52b3",
        "indicator--297c424d-287a-4eb7-b662-c5fb3679d8f7",
        "indicator--d6934ee7-848d-44e1-a3b2-3ad289e6e1a4",
        "indicator--1e728455-c2c8-4d5d-a74a-1cca75f18f00",
        "indicator--f828d00a-3a88-402b-a883-7f7a30ae60c4",
        "indicator--d8e66267-1bec-4f6b-a6af-459e392c43c6",
        "indicator--78ad70f6-4baf-49fe-9b32-bfa122312c32",
        "indicator--1932d63a-25d1-4dcc-9e45-9d514cd0be4a",
        "indicator--8694df63-367c-45fb-8e48-73a3ff9c9d1f",
        "indicator--1218bfde-dc0d-4183-9f18-822129011d4e",
        "indicator--aea92fcb-e4a3-484a-8524-7bfcecf3ce75",
        "indicator--45291395-c9a8-441c-ba78-0d48c14218b9",
        "indicator--f66a0850-1898-4714-b67b-d5f115fc3670",
        "indicator--d5b4fb65-dd79-4fde-98fd-88a465196940",
        "indicator--fcb667a6-c5c5-4d42-b922-be26abaa4df6",
        "indicator--d1b2a3e2-58f5-47ac-8037-94483806221c",
        "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
        "indicator--3959aff1-4012-4ae9-8b49-4f81fae2b3bc",
        "indicator--e76679e0-08ca-413f-9027-ffaf266aa77d",
        "indicator--2a709429-711d-41c3-aeb4-88d85b2336cd",
        "indicator--d8b3499f-ea95-451f-b047-f633c0fb3117",
        "indicator--2c132482-4e6a-424f-ac4b-c8e421153d7a",
        "indicator--ed8a6e8c-a8c5-4998-a798-0fc663004d11",
        "indicator--d213b855-f446-437f-bd4c-6c30c755fe89",
        "indicator--b0069be6-ed91-432c-80b0-18b9452d9b35",
        "indicator--4dd90f92-454d-4124-8f01-88c8fe0e76b6",
        "indicator--c95e648e-6bfb-4f96-b570-e7e2ff3371de",
        "indicator--4c442eaa-84c9-4c7f-ada8-39ba4061164d",
        "indicator--6d1b830d-89fd-4ecf-815b-3bed94570f98",
        "indicator--cf55d2f8-b789-4b3e-adf4-08219a438a1f",
        "indicator--eab585f0-fe7a-4cd1-8519-2d99cff97eda",
        "indicator--76397521-0c13-429c-9b39-2e2360d6d6b2",
        "indicator--3ebd6617-55dc-4485-b803-8f7619d625a8",
        "indicator--d9051e35-797f-4ba7-afd4-152479a31216",
        "indicator--9afe541c-6721-4634-b526-7b2b90deba15",
        "indicator--ae9d09f0-a979-4334-8564-d9a46cdd18f8",
        "indicator--67347f69-17d6-458a-afd0-43b0cfe441c4",
        "indicator--b742822d-1ff1-4966-992f-f18fcd51938d",
        "indicator--211ddca1-2e1d-4e0c-9764-b6231e5fe5f8",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--31f34209-7a14-405e-9f80-3c36202b752c",
        "indicator--c23e0b80-2271-43e4-a9f4-26d5dcf6113e",
        "indicator--b7066f5c-07a6-41bd-938a-38e62878adb0",
        "indicator--8443b76c-7453-4193-8bd7-652bf27c4be1",
        "indicator--63c09773-d60f-41a8-883c-f717fcc92b5f",
        "indicator--97f0c7ae-936e-4beb-9b6d-07f4889a0e0d",
        "indicator--ed7baeb9-42c5-4555-a3d2-a9043d820abd",
        "indicator--6d9aa3bb-48b2-4d30-8cd9-d483f6c43236",
        "indicator--c49fbc22-158b-468f-96ee-f00bb139115e",
        "indicator--b140d464-36cd-42fa-93ad-7a34455abd8c",
        "indicator--4a58624a-0bbe-4547-889a-807f727f21ec",
        "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
        "indicator--195c265c-ba6e-4c4c-b5a7-e4cb4e62e2a5",
        "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
        "indicator--f76a78e5-db82-4a81-92f2-861bfa0c564d",
        "indicator--b124619b-e56c-4884-9d83-175065117ddd",
        "indicator--855c5336-0a47-4a15-a0b1-96e1ed993175",
        "indicator--96a815e6-6676-43ee-ad96-fc5c17fa555c",
        "indicator--ae2830d0-362d-407a-8231-96a56b0c4011",
        "indicator--e6a73315-a61b-49e9-9e8b-d7f3d53d2b8f",
        "indicator--447f4ce3-8d95-462d-b3ff-37ed4380ecfd",
        "indicator--0107c02d-4c06-4ea8-8aac-63ffad262f4b",
        "indicator--d371dd09-310d-4251-b7e2-8b3f56f75436",
        "indicator--557425d8-e486-4937-9040-a955fab2cb55",
        "indicator--0e7489d2-51d3-4095-935e-8f6ea16f0179",
        "indicator--4dd4b46a-dff2-47ea-8f98-75c3eb80fc08",
        "indicator--8df8d3a4-1e01-4c94-bca2-e741bc8bc0e3",
        "indicator--4af24852-7d7d-42ed-92a6-f223a1b74c60",
        "indicator--1d2b648b-18ba-47bb-b15d-af0f06695a2d",
        "indicator--4ad1b747-d6cd-495e-9396-745f264f3bae",
        "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
        "indicator--37ea87a9-7096-4771-b54a-f7d82a80fc5c",
        "indicator--52b1c114-dbfa-4737-9a0c-1a5f02af55a4",
        "indicator--6a64770d-437a-4b32-a5f2-ec289be1b39c",
        "indicator--05be283e-b58b-45ed-b62d-e060cceec48a",
        "indicator--ec16b206-94d1-4917-867b-fcbf6b228c71",
        "indicator--e1975762-486d-4cef-9be6-1103ba7e6a54",
        "indicator--422762fa-b5fc-4763-ab59-cc7e9fbd7778",
        "indicator--3c9cfa0b-9658-4f30-8c3d-f88d103ea4f7",
        "indicator--b73aca7f-353e-443d-9307-c831267aba21",
        "indicator--9ca8cbcb-4da8-4b4f-a42c-2d9af8bbe8e0",
        "indicator--d1cca4ba-7ee7-40bf-8867-b086f1083162",
        "indicator--00b31c02-ab70-46c4-ba1a-4a56a6bffd8d",
        "indicator--64da3183-88a9-4e6f-a848-ef5c7f49fdc8",
        "indicator--61c22014-39c2-4895-b1db-5688f8eebc94",
        "indicator--97c8a29c-8b7c-4519-92bc-2773cf557c6a",
        "indicator--1d0aeb1b-56fa-48b5-8f54-258a729a578c",
        "indicator--6a621d4c-e553-445e-837f-83df2ed7562d",
        "indicator--61b853f1-eeac-4882-bac1-67c2940bdee3",
        "indicator--ce788332-ce8f-4a51-bb14-9e2dcdd8b9d5",
        "indicator--4f5fb056-baac-4df9-8765-bdf84b8c7cb4",
        "indicator--31a623b5-1d1f-422d-af02-4bfd830997b8",
        "indicator--a546a458-0790-42fb-807e-976f8a79d761",
        "indicator--d44611ed-e469-4c1a-8178-f6ffe830b310",
        "indicator--9271933b-b039-4fe7-8d49-7709d5c2dd7d",
        "indicator--564025b8-208d-49d7-abff-27bec28557fc",
        "indicator--74dec2d4-43ef-4811-90ae-2375a8bf9891",
        "indicator--5819201e-5960-4c3d-b520-7284f5b809aa",
        "indicator--6809f988-3142-41d6-a3f5-41879ebc003e",
        "indicator--2475f5a7-2a2c-49f7-8a01-22c61059d4ce",
        "indicator--5d36558c-32a6-4465-8da3-595628929543",
        "indicator--22c96740-3cc3-4ded-adb5-0e2934e0b1fc",
        "indicator--00c47b0a-e22d-420c-9282-34960a719b02",
        "indicator--a754fe84-1f50-4a56-b24d-6abaf078e699",
        "indicator--817d15e6-f492-4089-aa82-851062c9e2a9",
        "indicator--7364d9ce-f4ef-4b8a-b570-6b01fe682cc6",
        "indicator--29591884-a053-4e89-8d6f-274cb261ad70",
        "indicator--28767321-1c28-4d17-86be-eed6da0bbb51",
        "indicator--9bd2fff4-406e-4df0-9c4b-42622284225c",
        "indicator--4961d068-9e1b-4d84-9885-49dba7c118df",
        "indicator--c44e2a94-ba97-4224-9412-f27e6c61ed95",
        "indicator--205aa2e1-f21c-4396-a83a-111e14da9e3a",
        "indicator--8cd7c687-b659-462e-b2c8-0a0755e7851c",
        "indicator--27903e0c-5781-4b2b-a7f3-edecae02da4c",
        "indicator--a7b13c8e-2af9-41ae-ab62-6b18e5608fab",
        "indicator--04939fe4-f850-47be-911b-b11cf3f8c85f",
        "indicator--3b655385-efc0-4d3d-b818-27d9140eab16",
        "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
        "indicator--02d6f195-7091-4d53-a3cb-dc44bbd05068",
        "indicator--9de6679a-b550-4050-84ee-550928b91958",
        "indicator--ee600995-93dc-4e43-8cc6-ca92462fe9e2",
        "indicator--29da8f96-57b6-445f-bf1b-7be95a2a563e",
        "indicator--a1317c7b-4526-4a13-b955-2046d074d393",
        "indicator--cccc4f4c-8874-4993-b813-2a0190e83f70",
        "indicator--6aca70a6-537f-45ae-a521-0bb2327c7072",
        "indicator--8974ae26-4c27-4b9c-9ba1-812ae390d665",
        "indicator--c57f2456-f8dd-471d-ab11-63b83c52552e",
        "indicator--1687db26-60b4-426c-ab69-5810ac8d9327",
        "indicator--595e5db7-bc7a-4793-ab4d-7e3cb687f20e",
        "indicator--563081ad-ca09-4901-a822-294afba1149c",
        "indicator--e70a6b09-894f-437a-9d8a-2a8214fa87c3",
        "indicator--569963f0-7289-4610-b3d9-edfce77dc5fd",
        "indicator--e6a883d7-bae9-4ca1-8304-8de461f4afc8",
        "indicator--f628e081-0c46-464c-9158-706f27ce473f",
        "indicator--b8851fc8-4cb4-4063-917f-9f6e13251232",
        "indicator--154ce8af-eedd-4ea5-ae2b-e46003bed7c8",
        "indicator--c2dbeb3b-6111-4607-9eae-4ea62c0963b9",
        "indicator--4693dad0-d687-4cb5-8a7b-8a4aa5d5cfaf",
        "indicator--3b830e93-11fc-4cc3-9544-5fe86afa24ca",
        "indicator--d906ec8c-9a08-41bd-b9d8-378b3e623153",
        "indicator--95002d36-efa6-44df-ab7a-5b53e9627ed3",
        "indicator--52dc0fb7-3e34-490e-834e-e93750ec2305",
        "indicator--2ace7b34-9b34-4081-8b4b-cadac491a644",
        "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
        "indicator--383f3148-2476-4e09-90fb-443732cd8816",
        "indicator--0dc849ed-e1ab-4ac2-9cc6-432b636c1437",
        "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
        "indicator--7a216106-3b1f-4617-ab31-a4d66c4d7f79",
        "indicator--47aea7a3-ece2-4494-93e0-57c413d20e45",
        "indicator--772315ca-1903-421c-be56-8d23823f0b10",
        "indicator--5ba3bda3-037a-4bff-95b9-b3504704fa39",
        "indicator--91d21909-f5c4-41fa-8657-fc13b0b25537",
        "indicator--fa335703-0ecf-48c3-9c20-89194ed911d8",
        "indicator--00664deb-8818-4f22-901e-0b920d34eeba",
        "indicator--fc60f922-8181-4427-a345-cbe5bcd2e781",
        "indicator--a86cfaad-aa57-46f7-ab3e-eedb6b562601",
        "indicator--0610563b-da3b-49c1-9d6c-f415aa573ad9",
        "indicator--4d9e76a1-dd07-4740-a03f-af92a1412b87",
        "indicator--03cc9f05-42f4-4665-8273-1cb772c9eada",
        "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
        "indicator--5325b9ae-1809-48d7-b97b-1049c4fcbd4a",
        "indicator--fdee1ee9-5f56-497e-a59e-3d80ac8aaf45",
        "indicator--88edff78-d04d-479e-8b16-324f5013c4a8",
        "indicator--aca6e578-fbec-478c-8859-7ba30968e86d",
        "indicator--b49db0f2-9f22-47bd-bf0d-f0b98c7cde43",
        "indicator--4b87745a-022a-4bae-b4cc-a0a76fbaa67d",
        "indicator--9cc2d274-5e0c-4586-aca3-217cb67ac67b",
        "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
        "indicator--c3a3b5d1-cbeb-4c40-9167-ad903338713f",
        "indicator--600f4802-8243-4977-9e22-485013ba915b",
        "indicator--eb7f8574-0c06-495d-91cc-2792d83d8b7d",
        "indicator--471facca-9c40-4c12-b8af-72360e6ae529",
        "indicator--168f4d0b-f3c4-4d8a-8be4-511cf402c439",
        "indicator--9226a66c-397b-415e-bfff-c36bed92b0df",
        "indicator--af613487-6e65-452f-a176-be1808c65375",
        "indicator--260d58a8-801f-4775-8658-40ca11c9ca5c",
        "indicator--5d0ef1b9-982c-4c64-8097-fa19560ab64f",
        "indicator--897fe569-f9d1-400b-b0ae-2e35791bf228",
        "indicator--673d1a33-127e-4852-8891-e68352532d07",
        "indicator--45912d80-8be7-4767-a15c-efe264ae72ee",
        "indicator--ca0825b9-4dd6-4809-b53d-4e0d0eecee0a",
        "indicator--3b0d852c-e7bd-4dc7-baf5-78f265ada713",
        "indicator--8e3630cb-86e6-41f3-bd42-be4ed94b8503",
        "indicator--c4409c9d-2a3e-42f5-9fab-9d2f0713fcae",
        "indicator--ff25a2c9-1c6f-4855-a1c0-f1a9c746f9fc",
        "indicator--85a4f58d-8768-4cd4-9ad0-51cd2d3b516f",
        "indicator--93df145b-9e6d-4e4d-acad-f83829f9397a",
        "indicator--3e75ca62-bdb1-4ff1-9d2c-efc5e66c084b",
        "indicator--2b4af062-2e10-4ccb-9883-1ae10c40711e",
        "indicator--bf44a73e-62b3-477f-86a9-ef69bd3b141d",
        "indicator--6edf90db-c1a0-4fae-aa3d-c00fc65e26d5",
        "indicator--fcdbaa71-e088-49a2-9ee1-b11c51c7cba9",
        "indicator--d9335108-ebbd-4acc-b060-559ded4972aa",
        "indicator--81697947-7faf-443a-8bc1-d7634ffa741f",
        "indicator--b2af1522-8184-4c4a-9880-8eebaf52e475",
        "indicator--764541c8-ecce-4c36-8e7e-4fab58218772",
        "indicator--5b4475c4-6a6f-498e-9153-30f8ec462c8a",
        "indicator--27378944-80ad-4226-9b0f-a42a5a55410e",
        "indicator--7de9dc9c-7e4e-4111-abe4-1adbbc3774a2",
        "indicator--8e92e14e-fc50-4753-94ad-b814881b3db6",
        "indicator--07a79415-4b56-46c8-9b88-7b16c2e2a764",
        "indicator--4248f74c-93b0-472f-8306-17b23fd96900",
        "indicator--ceaaa541-4872-4af6-b4ad-b821786a37ac",
        "indicator--48011dee-8c5c-4607-a9c0-3ba583eb61f8",
        "indicator--0d6a3d8e-d05b-4c80-84a2-1060781a3af4",
        "indicator--4398a595-0704-4b0b-9f85-2e57e02f239e",
        "indicator--3c5dc759-6b49-404b-a921-e8296cb88cfb",
        "indicator--efb4d367-5778-4005-aa87-e5534f1770eb",
        "indicator--cf4a5ed7-7a52-4528-a0f8-7b22fae21d14",
        "indicator--f63bd928-4693-4b3f-a923-35ea8e19c432",
        "indicator--9ed83733-51e4-4c83-8dde-ff30478c5ec5",
        "indicator--23a8aaa0-6652-4228-a9a9-7da79856ee06",
        "indicator--2ed3ed07-c19e-40eb-8e47-0ce2d82ad92f",
        "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
        "indicator--ea3bc83c-de2f-4d11-996d-9393538063ac",
        "indicator--dda73ac3-543f-468f-976e-26b36ad5ac2f",
        "indicator--47da057f-6439-4f6b-a167-0fb537881bcb",
        "indicator--5e2ea73a-059e-4ba7-851b-20515163decf",
        "indicator--e60bd628-3522-4ba8-b33a-41806714502c",
        "indicator--10f9cd10-7f84-4367-b750-59f1f9764d6b",
        "indicator--1705ccc0-7b0f-4ead-bd52-f9623ef45c71",
        "indicator--62f6a5ab-674f-44ec-878e-560293581de9",
        "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
        "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
        "indicator--5707eac2-920a-4878-b6ee-4f3c1da92462",
        "indicator--34baca9e-571a-4430-854b-b0356a740ca3",
        "indicator--3d53ff89-272e-4a0a-b1d0-e5b85cb284fd",
        "indicator--57753c1c-346b-46ac-94be-e1b80db4c456",
        "indicator--0142405f-a44b-4e91-b114-54d07f5b8c1f",
        "indicator--f58f264a-b513-4cf0-86b9-0e5069424887",
        "indicator--8cd9772e-cc2a-4e1b-ac74-47fbd5306884",
        "indicator--0605e823-11a3-4892-9867-5d183f959174",
        "indicator--b4a29996-55a6-4a2f-ae33-a6da3b5d09bd",
        "indicator--106763b6-5151-4fe8-9ade-130253eaff16",
        "indicator--12dd3f77-c782-46e4-b17a-bc641d12dff9",
        "indicator--b81581cd-e0f8-4653-a477-5d172f6adc3a",
        "indicator--29fe10e4-1cda-42e4-b651-99746bf18c66",
        "indicator--a74a2c25-54d1-4261-bb0a-f2bc800cf30e",
        "indicator--5c4163cd-1cc7-43ed-9525-e5fa895646dc",
        "indicator--cb37e2a5-c488-4618-b3ed-04bf6a7092c0",
        "indicator--b373d794-097e-4d26-933c-fc56df17762c",
        "indicator--8654fd9c-7fa0-45fc-a46e-b4d90ec85351",
        "indicator--0c7e0680-0acb-4254-b7f9-d1bde0e7ecde",
        "indicator--100b4fd4-050d-4aee-abbb-02989146d175",
        "indicator--3e2d1762-072c-45e5-ba3a-2fd7c4e44ee4",
        "indicator--a7893a18-18d0-42a9-806c-df0dd851fd69",
        "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
        "indicator--5fe247b9-4419-41b1-ab83-0ee93a539fc1",
        "indicator--f5a58987-0084-4ec7-bef8-94e25d9c1fde",
        "indicator--5c730cda-fe9a-4a25-a8c3-ca7d2fc8e966",
        "indicator--18abc6e3-a900-489c-8781-1fd737a515e8",
        "indicator--5d5cfaa0-69e8-47ce-b111-e4174ccbc585",
        "indicator--19220024-6538-43b3-9674-67a5bfb48e82",
        "indicator--2f70e3fe-59a6-492d-92d5-d79d1fe8d042",
        "indicator--e09922a5-268f-4608-baf3-c6dfb8edfc97",
        "indicator--2e3816c6-13fb-446e-80b6-250e5c8c279a",
        "indicator--c6c70eb8-7c72-4f56-8f9a-a9bb2c488061",
        "indicator--b872f62d-8f2c-4fb8-b682-631b3ea257df",
        "indicator--52cf4b28-3fcf-4a55-b958-c2ee13c2b000",
        "indicator--f6ec04af-9584-4369-8ede-7f9e23295f9b",
        "indicator--5fbbdf25-38a7-44cb-87fb-25ea9e463a5e",
        "indicator--4214d066-82f8-4d29-bde9-599089430bef",
        "indicator--9b88d662-16fc-4d0f-96f3-cf183a8eda21",
        "indicator--c82200da-d2cc-4ff5-95ee-7ac027230202",
        "indicator--984236bb-51b4-426d-aad9-fc719bf60f33",
        "indicator--b5915a1c-c68e-4185-a4dd-da36f9eb6357",
        "indicator--9767bcf2-73c3-4c30-b83b-14a93963765d",
        "indicator--7f2e828e-548f-4b5d-82d6-33e7d5cb0327",
        "indicator--76ff9b75-13f5-4c09-a69b-0948b447902f",
        "indicator--fdd8bf8b-c510-4668-bd83-85cf078fdf0c",
        "indicator--342fa0ca-083d-402f-9025-d8be1286af97",
        "indicator--6fab4d11-8fce-403b-9828-74cab2402d5f",
        "indicator--7a8c6857-0a66-4641-a6ee-d25a2248cb07",
        "indicator--1ee3cdd3-e977-4fe6-8a3f-206274a69eda",
        "indicator--84f59d9e-8fd7-47ab-8470-2c58b7a56972",
        "indicator--cb686c97-8f75-4632-9163-5e89148c8df4",
        "indicator--d7575b85-70a3-4cd4-ba6d-4557880da44e",
        "indicator--697cf405-1fb3-4cea-b3c4-8b7d7f2fdd1b",
        "indicator--0f871724-9e48-4a26-9597-a82a47d17e99",
        "indicator--60af568f-e51c-4723-b3e2-4cccb5e6c624",
        "indicator--c1e09898-a73a-44db-8647-ed4551e09cb9",
        "indicator--b8268bfc-5c98-4fb1-a71d-e37f200a7592",
        "indicator--cd7d4bcb-b7c7-450d-ba2f-a362f233186e",
        "indicator--9abb2655-8bd3-4098-8b58-6d623fefc393",
        "indicator--8ebb6dcc-454e-4f80-ae91-5300b754e4c9",
        "indicator--fdb51c51-6884-4945-a242-a80b680cac89",
        "indicator--dc6bae7f-e2fc-4218-a40c-3494decdb990",
        "indicator--269bb4f3-0b13-4c1c-90fb-7a0df7a2579f",
        "indicator--e12c2c48-a1ce-43f2-a5bd-ee4cd0fc6cef",
        "indicator--eaa37b92-9680-47be-b0d4-7ab7d1aea101",
        "indicator--a04115ca-5e79-42b2-bea8-eab56ab0a797",
        "indicator--24b230ad-6ad2-4817-9f22-a160ec022807",
        "indicator--c7f8f65e-1a29-4756-8021-cca732d55274",
        "indicator--535df6a5-1637-4e81-adf8-6ba51a385d43",
        "indicator--66704f55-6eee-494b-91e4-8b2991abcb91",
        "indicator--152d7a9c-cb93-4040-b345-82fb231a1f73",
        "indicator--51de1ec3-de77-4542-a164-84a1fa87217e",
        "indicator--7c2554a2-4d5a-4a9b-bc76-fd1ce4f0d0bb",
        "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
        "indicator--506cb56b-5b09-4711-bce2-898f73226007",
        "indicator--f53a6405-ced6-443a-9ba5-214248251524",
        "indicator--55bd5cc7-66d9-4b69-a0bc-ed2b1e422a0a",
        "indicator--297fbdd8-1e59-4d9f-8f4b-9b815aaf986f",
        "indicator--e18685c2-5e37-4424-afee-d0db54f06e49",
        "indicator--f5e725ea-53d8-45dd-b91a-11abef408693",
        "indicator--20d6f92c-81c2-4118-a669-33aefac51ada",
        "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
        "indicator--3acd1408-2d7b-4ea7-bf5e-e73c66cfd0d5",
        "indicator--ca229e4a-e198-44ff-bc6e-1ebb73cbe22d",
        "indicator--c294e6f1-2fca-456e-a033-7abd1afe37ca",
        "indicator--ce1d315f-46d6-450c-8003-cc7eb927ee61",
        "indicator--4041d8c6-2e90-4bc2-9adc-cee2bdd71cad",
        "indicator--e97147ab-04c3-4dc0-b5f0-0a62b751b1a6",
        "indicator--2e82490f-bed9-441f-b19d-9af52ed49ba8",
        "indicator--4cf13900-0671-4810-a768-9392e63539df",
        "indicator--0fff9bcb-9acd-4597-ade8-acc7b408420b",
        "indicator--e46ff6eb-f186-4679-9b80-016d998931fe",
        "indicator--9016a757-4861-42eb-872a-22b26187c546",
        "indicator--84579cdd-392f-4b32-821f-a1d6f878d992",
        "indicator--b434fde6-7c37-4fed-977c-456a132739ad",
        "indicator--f7aca1ad-2ea2-4634-a612-4677a693bade",
        "indicator--8845a62b-2e84-4205-ab30-2a3c91bd32d1",
        "indicator--39ca5f18-78d1-43b3-a817-6dfe1b382ab4",
        "indicator--55e1f11a-d3b7-480e-9500-b029ddd21a69",
        "indicator--4a9323e5-6084-444c-923a-2d911f55d826",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--a61a5b9b-7035-48f0-b2f2-afd262f2a476",
        "indicator--e60822d0-71d1-4363-b3be-f612c9b094e0",
        "indicator--4c1378f5-e430-494b-b40a-86e0e9e5463a",
        "indicator--72f675be-9a32-403c-a041-0ba402218dbe",
        "indicator--08387e65-660b-4ff1-9c57-0afe7098683e",
        "indicator--5245059b-d5d4-4168-96fb-53c225f79785",
        "indicator--7f223ec4-017d-4457-864b-16217dcc431f",
        "indicator--b893af61-73ff-4657-b74d-c8205a2d167e",
        "indicator--b2db9170-7c88-47f5-8328-58d210df1c43",
        "indicator--ee847134-5153-4437-b161-f63adbacf6bd",
        "indicator--dbb096e5-9b76-4178-9f5b-62f3aac856a1",
        "indicator--81a787c4-4e15-4a67-85ba-33f8c077cdb8",
        "indicator--52f578f1-2f12-4845-8118-523d3c95bcfe",
        "indicator--18632071-d389-44bd-a134-bc05f298dd59",
        "indicator--3349a6c1-72a6-4a23-9afe-726ea5be6da3",
        "indicator--d04dbb53-4cdb-4dcc-b138-6fd0d20f990f",
        "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
        "indicator--464a375b-5556-46cd-ab61-fa0604d4556f",
        "indicator--53410b0d-639b-42ef-955f-c56a357498d2",
        "indicator--7c161f1c-f255-4c27-82bd-e9cbaceaa291",
        "indicator--4257b59b-4479-4ee8-bfeb-74261bfd2e9b",
        "indicator--5d2bdef6-2e62-4183-b734-f5ddd08b0482",
        "indicator--ddb7a8bd-49d0-4cc2-b50e-3708013c3a68",
        "indicator--8d7f7203-ab2e-4612-9154-650365a5cb74",
        "indicator--3339c298-48d6-43f1-8ef6-24b12bea9b38",
        "indicator--52856dd8-6ac0-408c-a399-1837f2d3ce17",
        "indicator--b7acd9e4-906f-45aa-a4b4-d49690b4fd5d",
        "indicator--ad6d4167-6223-421d-b6bd-16f91c58d764",
        "indicator--2858c35b-9a80-4cc4-90ad-4bdedfc9b902",
        "indicator--253dcd37-7df7-4acc-b1f6-92e51737ce05",
        "indicator--6aaee504-0f47-48bf-b272-ffc1a79b5444",
        "indicator--7e2be634-ae49-4fe2-b3e3-fdcceed64746",
        "indicator--dd361783-959a-4618-9b54-98871cbb828a",
        "indicator--422f362e-0453-4e06-a221-cae60f8b74bc",
        "indicator--076dd469-1a83-47c5-a099-e56c3a4f5f75",
        "indicator--3c2718b6-9e72-4e13-8b3d-e9b4b5736b6b",
        "indicator--8961816c-573a-4952-8839-4d1be4420b0e",
        "indicator--b18e5318-c324-49cc-975f-f34074953814",
        "indicator--a418725f-9b24-4448-abcd-49b7fde7040f",
        "indicator--719a76f2-d512-4bfb-b095-cca9e883e58d",
        "indicator--1c5cea85-14de-48c0-a1d7-47b51bc53a5c",
        "indicator--21681e72-7937-4648-bbcc-07ecf66c8747",
        "indicator--4122cf66-902e-4baf-8159-64f0860c875a",
        "indicator--a95f8b16-4e11-4ddc-99cd-bdda28a1ab8f",
        "indicator--1224d117-601d-4b0c-97d2-4d2ead0adabc",
        "indicator--1708ccdd-f13b-41f7-aa1b-03989a1981f3",
        "indicator--5b3a44a7-c8e3-4c06-81f8-eabb75944d8a",
        "indicator--1f8119b9-9811-42a7-a501-bcffd19bc1bb",
        "indicator--a9e35e89-e76d-4a29-8cae-b86bd52c0865",
        "indicator--b36f21a6-f0da-4572-b8fa-e00fb2c6bb34",
        "indicator--bb6612fa-6213-415d-9201-380933e22b32",
        "indicator--d7d85f74-d3f7-4904-85d8-dbdf4368f55d",
        "indicator--405e8435-d142-44e9-b42b-a2b0b4f1f14e",
        "indicator--2f6e1115-df8e-4d55-81e7-6c1b1e636f42",
        "indicator--3d2336bf-c23b-4594-b2a8-dd74be37f806",
        "indicator--830812b6-887c-4508-82c7-d488f8690a3d",
        "indicator--25826a0f-ec04-4e67-a2d5-bd3e60c2f2fb",
        "indicator--5f12cae7-b86f-41fc-828c-7e1d042c524f",
        "indicator--fc0fb92e-4b63-4211-b5c6-7a5825e7b571",
        "indicator--b763394a-d26b-414f-912e-0ae9dde41455",
        "indicator--9af5939a-d6f5-4cfb-8ff6-e60a1ebed274",
        "indicator--4425e12f-c6a2-4f20-aa42-327dcda5c9ec",
        "indicator--d0f4c3f0-382d-43f7-be8f-793af4dd5e7d",
        "indicator--419b9682-52ac-4ef2-9f98-d3a6b565e17e",
        "indicator--4140a4b0-56f9-4ed0-abb0-64f1c020fcef",
        "indicator--12f0cd0b-fea0-47b3-b562-ecd6a22a9543",
        "indicator--3780f74f-76fc-4f72-95c2-3de4a4fa6b0a",
        "indicator--534432eb-cfc0-44fb-96f8-39ccc57942e0",
        "indicator--6e950e2f-7a34-445d-a22e-3fa4b93f429c",
        "indicator--2c1b9620-0dec-43aa-85b4-231b2331cc78",
        "indicator--91129173-09d5-4f7b-88c4-72716ba8fa1d",
        "indicator--952df40d-ed3e-4feb-ae06-503ce76a0063",
        "indicator--3dee4c8a-ce67-4dbd-8b2a-fc24eae991c3",
        "indicator--51716bbb-ded1-4557-a996-ef6682a5bbfb",
        "indicator--509e485f-7aa2-411a-84d7-a428bff4baa9",
        "indicator--f9f1d73f-10cc-4ae1-934b-7604bfc3d304",
        "indicator--9bd5e0d0-ef3e-45c0-b7cd-7c15c8eb9dac",
        "indicator--afac38ff-dfa2-4404-adc9-1f9c103b083e",
        "indicator--32d596f1-beb3-49b2-8155-1abf97fdb9a0",
        "indicator--06282236-a535-4352-99bb-aec956d6e764",
        "indicator--1a13c98f-79dd-4f6e-a388-ab0457add13b",
        "indicator--11c3ab3b-7d32-4d45-ae63-4cbb5675a4a2",
        "indicator--95d365d5-00b5-4cf4-8bb3-9d526bbef65d",
        "indicator--06d0e4c8-bddf-4fa7-8e37-c25d7f5ece45",
        "indicator--f9de3444-1105-4bf0-84f9-cf3e6b2a2a46",
        "indicator--f5cf5445-4ec3-439d-b0b1-d1eeb0075b99",
        "indicator--52f63976-b451-4bcd-839a-1e7d0906b69a",
        "indicator--5909aafb-aa84-43b6-9d0a-c82b3acf22c7",
        "indicator--72cf6158-f5bc-4599-a685-116274ca27ab",
        "indicator--68e8516f-1dc1-4c2a-bc5b-aa3828eb00da",
        "indicator--f14f07c7-f1cf-4c18-acd4-d051e818f765",
        "indicator--f8d5a2f1-637c-4278-9039-a9d6df62207f",
        "indicator--69c7658a-579b-4868-a8b5-e85da30f499d",
        "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
        "indicator--256f4ba8-786f-43dc-b140-fe498a6f2c68",
        "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
        "indicator--6037c128-a9ef-4a0c-8045-b28fb57d8612",
        "indicator--c9dec768-54fe-4627-828d-785930ef029a",
        "indicator--bab3d4a0-aa9e-49e0-a1f2-e59cb7b83709",
        "indicator--30e194b8-b0bf-45c0-8aff-09fcecaf2328",
        "indicator--eb868bbc-2a0b-4643-a97d-90fda4bfcedf",
        "indicator--d2f24250-6ec7-467b-b499-f1d3e418a705",
        "indicator--2fb5a48f-12de-4329-8f01-613a756ed47c",
        "indicator--09335390-2812-4dc0-beab-245b50730afd",
        "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
        "indicator--099e1c1c-df05-4a9e-8a59-99cdae66e6cd",
        "indicator--07925285-c5c9-49b0-868e-5d52fb805567",
        "indicator--ab54f0e4-4168-4707-9f9a-525cf385e062",
        "indicator--6423fdcd-4169-4274-a04e-7f9bd57336bb",
        "indicator--bbce3b02-8dc2-4823-9665-05daa7cafbc9",
        "indicator--4ec1fbb5-8c38-48b0-a9b5-41a72f59c8d0",
        "indicator--9014253a-3cee-4c83-bb2a-e4bc6ffeee6c",
        "indicator--51bb20a1-0256-4f24-90ed-80a717616274",
        "indicator--01050d42-be1c-4c65-aba6-47099669cb78",
        "indicator--ac233baa-fa52-4b20-adff-a65294cf54f4",
        "indicator--4246e799-9665-4d70-aea5-4624f5e3607c",
        "indicator--3815fc90-a11d-40fc-b90e-51970b8815dc",
        "indicator--7fb4cd89-2d5c-4d31-b992-01dce94589a2",
        "indicator--d2c28785-b3de-4193-9fbb-4906902b63f6",
        "indicator--39ce3285-b0df-4089-a266-45867a653a75",
        "indicator--b3f5e0d1-6bb7-407d-a03d-126cf792a463",
        "indicator--99ebc073-7c0b-4b13-9f08-5d20a2a9314c",
        "indicator--35462252-23c2-497e-b967-50b4a67793b0",
        "indicator--19984777-ae25-4e70-9d6a-0db02b9cc1a9",
        "indicator--9a00837b-8b6c-4f56-9607-ebb3ba4ee6cc",
        "indicator--dc7a05db-2da9-44ba-867d-74d770f7b5dc",
        "indicator--811d54c6-4ae2-4db0-9db7-322cad2c1965",
        "indicator--d9b11ed8-e922-478f-b8b4-d5152415d1ec",
        "indicator--88b8fdd6-65a2-446b-bbb8-4125975ee65d",
        "indicator--5e7c77d4-f888-4d4f-99f9-ced89e27bf56",
        "indicator--720227a4-17d1-4642-833d-af0e771efc8e",
        "indicator--2888a66c-71e8-49d4-8ad5-dff546010227",
        "indicator--a7d587df-9000-4e18-a835-e009f814410c",
        "indicator--59a77135-2411-49cc-bb61-b036afb844a7",
        "indicator--c98fb897-864d-4138-b181-2a167dfab483",
        "indicator--14e670ed-2aa5-481c-b8fd-5d17017b3640",
        "indicator--0a4c216c-4d06-4df1-8a39-d76a4e3becef",
        "indicator--fc6d63d9-e747-40e3-8524-3691d07c431f",
        "indicator--2996da16-ac0a-438e-8ab2-e69c260215e8",
        "indicator--e9158d2d-276f-48af-af56-2b2b052c63fe",
        "indicator--459c5cd8-0391-4d76-931e-b209ce39d32b",
        "indicator--f7cc4e63-83e5-4ceb-93d9-0ab2b4d2cd68",
        "indicator--0f7faeaa-b5f4-4cf7-bf78-dd0f4eb98197",
        "indicator--e82d1524-fa6c-438a-a028-7242bb7cd736",
        "indicator--8ac464d1-ac04-45b0-9d1f-2eaee6c5de06",
        "indicator--1ac3c391-8260-48b0-abcf-c191a27b49f5",
        "indicator--ebad4074-b6a9-47fd-a12d-34dc6d682688",
        "indicator--1aa812d8-e164-42b7-8a0c-7852f468f9d9",
        "indicator--2b808a2a-6955-4093-8045-c1f669609d83",
        "indicator--e0d08ade-1b74-43b7-a775-d15a4f925817",
        "indicator--97f5ab4b-2c8a-4b1b-855d-3c63d2a20e91",
        "indicator--1f42a9c5-31cd-4e33-9b67-00657c6f3dbf",
        "indicator--3a059d16-04da-45a8-84da-ea9d4f559aa8",
        "indicator--ee9908e1-0292-4f97-9572-a1a16cd598b4",
        "indicator--cc05f6d7-4b37-47a8-8840-680fd274f515",
        "indicator--b323bc15-1403-4a2f-bca3-4493c60a42f5",
        "indicator--429e0322-c108-4782-926b-f1e672c230de",
        "indicator--9ecde781-f464-4213-9c30-0fd9c9864c45",
        "indicator--469fff75-b4f0-47bb-a803-39bce634e371",
        "indicator--52c6f886-76ad-4163-b08e-0af4cf6ad2ec",
        "indicator--00f32cae-b9db-4121-83ad-1f8cd0fb7393",
        "indicator--df8879bd-52c5-4d25-897f-7d9cefdd1dc3",
        "indicator--8e87a255-f412-493f-85bf-f062ba816593",
        "indicator--6942741f-e57e-4fd3-a5f7-1e4687e77f68",
        "indicator--a795bc3b-bb60-4030-8e36-bd190522b8aa",
        "indicator--07c6fe26-7941-46ef-92cb-69df83a052c6",
        "indicator--f570288e-3865-4091-9937-4dd4aaee81fa",
        "indicator--e88d6af1-6dba-40f0-9bd2-c26789d64c19",
        "indicator--e5b095c2-c04e-48ff-96c6-1191faf194e3",
        "indicator--89733341-eb13-486b-a7ff-953201d0f4dd",
        "indicator--0c13ce14-e7a3-4ce9-8e1b-5b18f7d955ac",
        "indicator--b8481cad-a230-477f-82b6-8c77699df44a",
        "indicator--ef357e44-dc21-440c-a914-071e3a6283cc",
        "indicator--e4d27291-6914-4d2a-96ea-73b3a8be7cd0",
        "indicator--00ddae1e-3224-4603-b24d-92ef97e7bc2a",
        "indicator--a8c38136-ff7e-4960-bac4-6b1a34e4dfe3",
        "indicator--bafe7857-74a1-4a8e-848f-29e7d4f1bc50",
        "indicator--820bfd27-cfbd-4c3d-b507-a250e32caaee",
        "indicator--700325c1-90fc-4f19-be1f-539d20c03fc0",
        "indicator--21c5004c-c303-4b3c-b825-5c08e51b381a",
        "indicator--eac84cb7-3712-4468-9d75-fa152d7069c2",
        "indicator--397c9ab4-226c-4627-a00c-de46516f2b25",
        "indicator--51c1aa80-2310-40a0-8907-6b3f99d47db6",
        "indicator--86a30b23-bebd-43f6-ba21-6147175a79fc",
        "indicator--ccb26c5a-9829-45fc-9f02-4f2f8ffa58da",
        "indicator--f285dd98-d9e3-468c-b065-34361641ba9a",
        "indicator--74881bf5-2472-4c71-acb6-d54eb955ee03",
        "indicator--e5adfc59-2989-4ab3-a0fa-67853a81f457",
        "indicator--17664a58-2de4-494d-8cd3-1e00dfc60c91",
        "indicator--dca30a04-2505-417d-8f00-82eef1147302",
        "indicator--67300684-7db0-4299-b184-bfe084b3ceea",
        "indicator--723e8f49-48e8-4c81-872b-9bd9dadff705",
        "indicator--de1b56e5-731a-4cbd-abaf-2e43f32cbbbb",
        "indicator--3788e15d-b735-4c90-8634-d847eafee109",
        "indicator--39f63664-41cd-40c4-98eb-58a3504f764a",
        "indicator--51ea1126-2cad-4459-952c-fe96cb5d13aa",
        "indicator--81328fbc-5c1b-4aed-969e-a01f5601be22",
        "indicator--b5c2508f-a690-4f8a-b306-735e844784a8",
        "indicator--23d05474-5ca2-49c0-9b3b-9d3a0f24f2ba",
        "indicator--d7793e38-d22f-4c27-944e-2f216af72cc5",
        "indicator--c973b386-8ffc-45ec-8704-ffa9d94f5990",
        "indicator--deb04c9f-fb0e-4f9c-bced-28721aa78b4c",
        "indicator--6f086b96-bd77-4260-83d3-67ddec5c8680",
        "indicator--ec196b1e-9cb7-46a6-af75-72d6b222a509",
        "indicator--eaac2875-2cc0-4024-aa2f-0f44dd9b08bf",
        "indicator--8a4e10ca-f3e8-41f7-a366-db276eda9ed4",
        "indicator--7485b147-372d-4d48-9a70-0bc527f122bd",
        "indicator--8c426df0-b0cd-4ce1-bcc9-29e0ac7a720a",
        "indicator--7e2251cb-4c3e-4c71-8bc6-e33de8a815fd",
        "indicator--6737886a-c59d-4d19-ad2d-14abafe16f71",
        "indicator--1ddad8ea-2536-43c4-8ff3-325cb2739874",
        "indicator--8f78aaba-1583-4b48-a65f-15aae7063b10",
        "indicator--779c0f72-25d0-444d-a57d-187b6069a18a",
        "indicator--05352936-a05c-49c6-ad73-0777f0046e5b",
        "indicator--df8088f9-c4ec-4cbe-bab9-2ba489010bc7",
        "indicator--31b19b88-24d1-4344-90d6-bc45a7fc2ed5",
        "indicator--30214f74-3d31-40a3-8054-0b3fa025cc23",
        "indicator--3f67b1df-dce4-4f1f-92cf-7964e1c63f47",
        "indicator--2a5e485b-5ca6-47b9-818d-e8c7065aac1f",
        "indicator--0b79332e-ac0b-4092-85c6-fde9495b3de7",
        "indicator--fb2b1927-8037-4664-9b1f-9a9652632366",
        "indicator--56f0b297-8dc9-49bf-b3e2-eeee33229ee8",
        "indicator--112922fe-b68b-4312-aa59-061560b8b3af",
        "indicator--b5a667a5-1973-4a7b-aa5f-fcf46e525154",
        "indicator--ef0cbb50-d64c-465b-a33e-ec76528039ba",
        "indicator--9e10b2d0-2226-403b-a355-3bcb7395a6ec",
        "indicator--0483c586-7ce0-49ec-acdd-5de57c9f7a16",
        "indicator--d85733f4-46b6-46b7-b6c6-2b6adb0a75cc",
        "indicator--fea5da50-a595-4d29-9b3e-622a98b653fb",
        "indicator--84cf06dd-6bbc-4a37-946c-4d4d09b93101",
        "indicator--e500fddb-a6e6-47a7-836d-f57854303eb6",
        "indicator--90cb250f-5ec8-4641-afd1-ad2edd088ef9",
        "indicator--07b5d167-ea60-4bb9-9a39-a15c3cc27720",
        "indicator--6133c3d2-5eb7-4726-9baf-db355249a343",
        "indicator--9e034cdd-3d83-43fa-85e3-4add99331489",
        "indicator--ffde4a18-95c5-4454-99da-d1c135400c3d",
        "indicator--0b7caeb3-8919-44b2-af76-4da7f0130e15",
        "indicator--355b0a2d-93d3-4382-8f28-32a3aa5f8f62",
        "indicator--9b24565d-b035-435b-bcda-b2f1a712c122",
        "indicator--446fa8b6-2d2e-46a5-b4af-c8d7478424e7",
        "indicator--32d88e51-0662-4689-8c61-a720adf27d64",
        "indicator--8bb609af-94fa-4d3d-8b92-ab6a90a25162",
        "indicator--0e391335-45f0-4e11-8d94-f093077f9cc6",
        "indicator--d3febe87-eaca-4b05-9db3-e6ca47fb6959",
        "indicator--172626fd-bb3f-4b85-a5a9-ee260dd0e198",
        "indicator--9f861523-2311-4539-97b1-8ea63f4e4dcb",
        "indicator--741b6276-b592-4494-8a13-da43dba52f9a",
        "indicator--1852ed07-c2b9-4219-8020-5016cd293979",
        "indicator--b6bbe81c-0827-4bf5-8abf-2a759837d861",
        "indicator--370e21e1-84dd-4540-9685-8b5b9c997c50",
        "indicator--c32c5d30-a961-46b4-ab02-101bc0acccde",
        "indicator--a8570945-43ac-4782-bf8f-f9f4855e855a",
        "indicator--86dc2aa0-e14b-4b40-9916-3c1c3c5ea0b4",
        "indicator--cba22fa5-e8ce-4cbd-ac81-1e7023cd4f4e",
        "indicator--bbe30a0c-5c6e-4ca7-bc31-870ef5ba79a8",
        "indicator--fc9aaf2e-3a49-4e39-a37c-2015917f6627",
        "indicator--4174a518-a30f-4a3d-83d5-6dc9715a4191",
        "indicator--401c3d37-4e7d-44e3-8f31-2f0c0721ed65",
        "indicator--e8587044-dc4c-4219-8c94-f93074fa4e5d",
        "indicator--7170bfb5-f222-4bb9-bde0-503440dab77d",
        "indicator--7d1f91e3-601a-4d1c-8f1b-f2a0dfa91c77",
        "indicator--dbfc8322-d9d8-4e3e-8d2c-5a99686c9ec8",
        "indicator--d1df47cd-1c82-4870-be16-a1671d967f74",
        "indicator--9617d9e2-65e7-46fa-bf34-a76a515a91fd",
        "indicator--76c5992b-4aab-4ad6-ad10-60fbe8b214d6",
        "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
        "indicator--76d16c67-87d9-4520-8041-4680150cf303",
        "indicator--01f78a17-6eb6-43dd-9169-221e8af4771b",
        "indicator--796bc7e5-1b85-41b0-b65a-f9179fd657bd",
        "indicator--bf943747-cf62-453b-91cc-8d17fcd93872",
        "indicator--ee042b0f-42c6-42c9-b206-9d209fb819b1",
        "indicator--37c1d41e-1b16-40f2-b690-3a1ddcfb0c0b",
        "indicator--cc040875-fd7f-4463-8ef2-8c5c93a71026",
        "indicator--306287fb-6c84-430f-88fd-9ede282e9d26",
        "indicator--ab87b180-3e8f-43c1-aceb-4ee23fdc1979",
        "indicator--467c18c4-5fca-4c4f-935c-0fb87414605e",
        "indicator--c540e265-a35f-4e92-ac2e-1cbd2ccb4c26",
        "indicator--771828b4-c58e-4e12-a6cd-27b8d61bc60c",
        "indicator--5597565d-f447-4807-881d-9fbc65d32274",
        "indicator--f8dabd1f-8ac5-46df-9250-4f19bb547711",
        "indicator--f5ae8a15-6906-4a6a-8278-f695864be67c",
        "indicator--d8d8d10a-ddbf-4e95-ae12-95141ebc99d5",
        "indicator--54f8dcc1-00a9-4d1a-bddf-5760359eb4eb",
        "indicator--3151416f-6757-4907-89dd-74e0ad76e7a5",
        "indicator--b8c22f9d-a065-4ddb-8788-634e1660a6ac",
        "indicator--0260b4e7-2761-4c96-9fc3-6b7806ece872",
        "indicator--8a39cd2a-c318-42c1-8fb4-6b176b6eda97",
        "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
        "indicator--53218435-f995-491a-a705-38b3c6cee35f",
        "indicator--b886a116-ae64-4e67-a500-dbd85a15ebae",
        "indicator--67cdd67d-35c1-4790-be8a-15848be93680",
        "indicator--192158dc-4119-45df-8598-7d081601734f",
        "indicator--f3d24905-4623-4a8e-bf50-f9b402db272b",
        "indicator--d8989c06-7a0e-4163-8a3a-479b803a0b34",
        "indicator--aa3e15ef-f535-4534-b463-c8804999ffdb",
        "indicator--5b57d99f-3a63-4cc7-9630-6036118b6630",
        "indicator--ea9e99a0-41ef-442c-8547-ed83206f7012",
        "indicator--c7182fd5-feba-4785-b44d-6fb52630f93f",
        "indicator--3d3252e4-26e8-4999-a79c-8eeae2d7e5d5",
        "indicator--7bd5b43f-2d8f-43f6-8096-64a57429ecab",
        "indicator--837d37c2-cd06-47fa-85af-9a7c585fad93",
        "indicator--12d5dc22-3f6e-44a0-8f33-5fa46e1c58a1",
        "indicator--ed48f483-8b72-4c01-8099-8f201fe9dd5d",
        "indicator--1862bae2-bfdd-45cf-b534-7de5e983a07c",
        "indicator--d81aee51-0bdd-4ca1-a989-9922c9117eec",
        "indicator--3adf30fb-1953-45f5-b9f1-fe9417d41ac3",
        "indicator--32b2a351-3a7e-4a39-a050-bc793a261373",
        "indicator--608d18f0-c115-47d9-9165-48f6cd28e2d7",
        "indicator--5fcaef20-9988-4f9b-8d8f-388de2c21a99",
        "indicator--22356e87-9e20-4db9-9cfb-3f9e24b4fcf0",
        "indicator--614e381f-ddae-4fda-a185-74ff1d965e49",
        "indicator--fdbb9cce-74bb-49c3-9a32-20335ab3fd8a",
        "indicator--85eac18e-7dc8-4c1b-819d-e2e7c17402b5",
        "indicator--460124fe-f37d-44b1-be51-b3cb8b28dd9b",
        "indicator--10a7fd5d-b821-4f1a-8181-a28412f28da5",
        "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
        "indicator--f06ec988-b8a2-491c-b445-c818eeeab1af",
        "indicator--d5ff9dea-9a1c-4aa1-ad89-797229ce90ea",
        "indicator--fd169adf-59ad-4024-8405-388ab4ea41e6",
        "indicator--1f9e88fd-14dc-43cc-842e-ab4cfe79d1a4",
        "indicator--8b439573-64f5-4a6f-8f6a-b0814764f70d",
        "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
        "indicator--e67682d2-6dba-4cbf-8941-ef3f93c04c34",
        "indicator--28c01199-82df-4d05-ae89-1ebd244ad9dd",
        "indicator--15d05585-a95f-4d3a-a71b-aef1013ec9a2",
        "indicator--27b4d742-7e08-41bf-8c4d-8e0db7f42ee9",
        "indicator--90f9857e-da2b-426b-a844-4a76a0edab03",
        "indicator--19a4f6ec-c2d7-4e97-8cfe-806b2ae28adb",
        "indicator--0b86ba45-5e18-448e-83bd-a8e159dcce6b",
        "indicator--7f61ca04-af93-43e5-8c03-29a2f7825d44",
        "indicator--50b7233b-27d4-4b38-8d0c-40ac8f6a7328",
        "indicator--23a0c8ac-35f4-4fe2-abef-271bb030534d",
        "indicator--e1e53599-d52d-4218-84c4-c96f1edc6a21",
        "indicator--048e6b43-256c-45ec-8b04-6c31b4257e72",
        "indicator--e401ea77-f12f-411f-8d88-e04708e6d9e2",
        "indicator--d32d56a3-8a6e-47fe-8af7-6e4b9127d785",
        "indicator--e6fe80de-2109-4040-a2f3-d5656a419f90",
        "indicator--6fbce0dc-5057-4abb-ac0c-7dfe69e33eea",
        "indicator--2f3d1bd0-e306-4d7a-9f4a-db76b6607d26",
        "indicator--b61ed9bf-28e8-45eb-9394-5179ca5b0fbd",
        "indicator--f323b0e1-6385-4542-b245-fa9bbde63c74",
        "indicator--1dab3f0c-bdaa-47f1-ba33-f59e53ac3be6",
        "indicator--6f3f7680-e0fc-4ff3-a4de-d7f5443298d0",
        "indicator--319e5b04-20d8-4e4a-9a26-23159991119f",
        "indicator--9c9cf4c4-8d48-4c96-bfd6-375a8d1a089c",
        "indicator--7f4c76b9-34bb-488b-8f14-72a102c8cb25",
        "indicator--91892da3-3027-433f-bda3-8561b2e8b0d6",
        "indicator--7d58ce99-ecc5-4aa2-b21f-971bd5df3a16",
        "indicator--adaf6a27-ece9-4f2a-bf64-31c6eac3501f",
        "indicator--2296bb63-4b69-471b-bb78-5c201216bea8",
        "indicator--697cce24-05ba-4e07-aa81-4993024d0623",
        "indicator--62332ade-d941-45af-8556-7c1abcdc4508",
        "indicator--b6ea4235-db60-46d7-8270-18a44ee18e4d",
        "indicator--64b65b9a-4255-444b-92ce-7b12ea16561b",
        "indicator--d4899af5-c4db-4b00-9366-b619fedf719f",
        "indicator--a065ef79-cee4-465c-a186-ea8e64e8178c",
        "indicator--5a8a78e7-0036-44a8-aff3-6c606256a2d6",
        "indicator--1ec6b7d2-2287-4f2e-9166-a8e2505353b4",
        "indicator--0b080684-3919-44ec-9e5a-561c31da0e2d",
        "indicator--434b4373-35ea-4397-a287-24b08f1fc4df",
        "indicator--3ba1542a-9f66-47f4-84da-433ee7116459",
        "indicator--962fa6e7-26ba-41c2-9a42-4845372e2fb7",
        "indicator--efd14145-1d95-4bb3-9506-9a07544713d6",
        "indicator--fb3849ca-a5d0-4997-af47-da2b9e933d8e",
        "indicator--13de0dd0-02e9-4386-b30f-3d37efd8dc84",
        "indicator--ea9eb1e9-21f5-4c42-8771-b2929cd34616",
        "indicator--d41be145-759e-43fc-9fb6-a4331a5c2dd0",
        "indicator--34e30848-e225-46b2-90be-87db3a56e3ab",
        "indicator--95cc05ad-b2ff-4ff5-8cd7-1911dac7ec46",
        "indicator--f0fb0e83-aba9-4743-b3b5-1331033817f0",
        "indicator--4f4aa5b7-fe72-46dd-97e5-c8f52d233ee7",
        "indicator--f530fd5f-86d3-4d2a-9e3c-370a3dc340bf",
        "indicator--b3ff0e1e-2ab7-46b4-a3ec-b710ba3b3916",
        "indicator--d5bdd07a-642c-40d5-9d1f-ce4cac3b2c8c",
        "indicator--a1cd9545-18cc-49c0-9458-78a2999c4f63",
        "indicator--48f22886-afcb-413e-9a82-5d7b3c9388f9",
        "indicator--c7506e36-4cb6-4e39-bef1-2fdbc5c30141",
        "indicator--f3dccb34-9b77-42f6-938d-0e9e791c928f",
        "indicator--e59616e4-73bd-45dd-bd9d-e1b2203426b0",
        "indicator--7d50b12b-2bb4-4eb8-88ab-1973174a3b2a",
        "indicator--9fe054b1-7d2a-4929-a976-1078547377c5",
        "indicator--cffd0254-b4bb-4e8b-b9a1-67623793f62b",
        "indicator--259477e9-c9d1-4c7a-a8d1-7076a217ff38",
        "indicator--4b99b7d6-76a2-4c1b-8bac-dba13d4af89c",
        "indicator--6a11f28e-2040-4f7a-93a5-74cae9919f46",
        "indicator--8497153e-fc07-46ac-8e15-89475a49d568",
        "indicator--96913820-ac0c-498c-affe-28b4727305e7",
        "indicator--4092b0ff-fc96-42d8-a706-18942756e247",
        "indicator--3c5dd6f4-4c74-46c9-bc8c-f9fb25f246e2",
        "indicator--e2dcaf49-0295-4f1d-92a6-d99cb97279ac",
        "indicator--7442f671-5c12-454d-a52b-59e1501f22d4",
        "indicator--26a250ec-aa8f-4775-854d-20d0b3716056",
        "indicator--136457b1-50fc-4b77-880b-eaa0846ac949",
        "indicator--c8896f87-5745-457d-9ad1-ae5718fee0c6",
        "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
        "indicator--badfcc20-f8f6-47e6-b510-ea78dd46c651",
        "indicator--032578bc-df4e-45c3-a403-f8d0882bee16",
        "indicator--f585fe04-618d-46f8-a7f9-908f4ab968af",
        "indicator--9893d19c-eec8-458c-9047-a7ca9e5238e2",
        "indicator--1d3a29f8-2439-4663-b339-9ad424a89afe",
        "indicator--60b03484-0d05-40e7-b252-8d13c3e2194e",
        "indicator--1bab34f9-646c-4fe0-ae7d-9a1afa441596",
        "indicator--fc28fe2b-d38a-4bb3-ab88-d2bf58caaf00",
        "indicator--1181c61b-a799-4650-bcfc-07dd5f3b1d43",
        "indicator--12269ea2-f5e2-4c0b-98a6-a6aa70453f3b",
        "indicator--4a92093a-d10f-45e7-b7b4-cc83c58c8fb9",
        "indicator--b6abd03a-c856-4670-86b2-62a0bb0dd04b",
        "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
        "indicator--8e7c50b0-5e74-4ef2-bd9e-ffef4dc44ff2",
        "indicator--4f5b00c3-dcc4-442b-8354-178a0e99d384",
        "indicator--6a2ad340-a226-4286-a82f-51ca31012993",
        "indicator--a748fb2a-4226-454d-8aea-26864112328c",
        "indicator--e5ea6ef0-39f8-476e-a6ec-2ea2c90d47d0",
        "indicator--764533de-8194-4ac9-8562-5d6d24957128",
        "indicator--010595ec-6830-4d76-8b4c-0b40d9ffad7a",
        "indicator--50edacc2-8b85-4f62-b361-3a27c801e03e",
        "indicator--51dda3dc-d400-4962-81d0-af9560917347",
        "indicator--bd2b535f-30c6-44c9-8cf2-de2c99b7a20c",
        "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
        "indicator--b83a3310-e5fa-4462-ae74-2625d1d3fa54",
        "indicator--bd6ce9eb-c453-4473-95ae-ccd4b86a3e30",
        "indicator--63f5f1b3-34c7-4343-bae8-e3ead63eb766",
        "indicator--e2aaddb3-bf86-43a2-a2a8-e38841436f08",
        "indicator--dd92c321-4615-4bda-bd0a-301a8573c4ff",
        "indicator--b42d4b38-2402-4219-a47e-4a77d997782d",
        "indicator--e8d2c6fb-9b59-407c-bd9f-6104a6dd31f6",
        "indicator--e2c18689-19d2-4ea4-828d-6851bb86b4e0",
        "indicator--38f0ccad-a114-48ac-ab44-539610f0eea1",
        "indicator--a00b3404-6a50-40b4-bd4b-17eeb2f169b2",
        "indicator--18ad3ff0-b49a-4d15-bc40-ec745ce9a750",
        "indicator--0d6ebc25-9c32-42b6-b46d-39c665f485ca",
        "indicator--364ee670-1aa6-4ccd-81e5-ceef27114c46",
        "indicator--e3ea0328-cbf2-4e81-8865-a70324bf19ee",
        "indicator--5d51e596-0068-4235-8ac8-986a44f32478",
        "indicator--3e201a0f-dd4f-4df7-b4df-f1f799d5893d",
        "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
        "indicator--3b48d475-cbc8-4971-a586-acb2b4ae0cd6",
        "indicator--85283f52-8700-41c6-b787-4191987eec43",
        "indicator--47b41402-de3d-4945-ab96-0c2479621170",
        "indicator--d884b05e-c82e-4ef4-ac6e-8e6f6ff88f44",
        "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
        "indicator--f89f61d1-3222-4314-9dce-643cd598b89a",
        "indicator--36ebf076-36e4-43e6-9459-14a2b358867b",
        "indicator--644c36bd-05e4-4555-8c93-862d69f379f5",
        "indicator--d4c2c130-6c9e-4765-ad65-b4339d3209b0",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--9d4d3268-8865-48d7-a841-d9ad7baeeae8",
        "indicator--99cc663e-1d02-4987-89b1-db98b61e0a5f",
        "indicator--39b86dc8-cc86-4e2a-9294-80f44cc6905c",
        "indicator--ba980708-aefb-47d1-a1a0-200a051a2376",
        "indicator--f6fd302f-85ed-46d0-848f-5cb273c84d25",
        "indicator--2941c7e9-6756-45d7-93bf-c6b05ec74e9e",
        "indicator--d957e995-1d2f-4ee3-90e7-51a04477eabf",
        "indicator--11f89c53-590a-48cb-a8ff-11615816e110",
        "indicator--c380e818-9fea-439e-873d-610dffa9fea9",
        "indicator--cb17b7a8-9480-4948-9d0e-cd1b26976c8f",
        "indicator--45e636d5-1e8b-4cf0-acc5-3838a673a261",
        "indicator--8506fabc-c4d9-43dc-ab0c-8a8ce2dfb643",
        "indicator--0a67906f-a845-4767-a710-2aa9c28098b4",
        "indicator--f273f529-72af-4e8b-8625-319553176656",
        "indicator--eb2af5a9-30ae-4832-addf-365f767d41cc",
        "indicator--a6049f24-8650-4273-9511-0542ebef210c",
        "indicator--8489dfb5-e65e-4dc5-903b-d53a59ccdd91",
        "indicator--e9d822bd-a9ae-4131-ac3e-f690b81b22de",
        "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
        "indicator--da78b1c3-24c7-4fe6-a46b-438cbf8d6911",
        "indicator--7eef1813-7e33-4073-b7f5-fef93cc39ed1",
        "indicator--5b67a3e7-22a5-4016-9d35-b914eb9f17a8",
        "indicator--605de8e5-0fb8-4735-816e-9bfb7fb444ca",
        "indicator--5ea0aaaf-db4d-4246-b4e6-41de1024e662",
        "indicator--1877aa05-460c-447d-b9a1-5ba66c617929",
        "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
        "indicator--ffc71754-66f2-4101-b54a-4b59321bbcc6",
        "indicator--dfa18525-4ff6-41fa-950e-ef79430ed9dc",
        "indicator--27b67c62-d4d6-42ae-bcb9-a1cc082523cb",
        "indicator--5905689a-c3e0-482e-a166-e2e5027fcc7d",
        "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
        "indicator--b31fc539-340a-4f50-86ea-e8d6025df4de",
        "indicator--43159ba6-577a-44c4-a578-fef5db0be810",
        "indicator--4fb74f05-e69c-4564-9289-e3cebd776ed6",
        "indicator--b69f9502-861c-4d47-9d93-0d2e9fda2ca3",
        "indicator--04e71c24-140a-466f-b188-5ab4cc6e7424",
        "indicator--56e4da95-8d83-4760-b1d4-b87fdebc703b",
        "indicator--d19699a6-161a-47f8-ac45-b9e85b30570c",
        "indicator--509b0ccb-a518-41f4-b4c1-76a7ac44fa71",
        "indicator--1625578f-98b8-4a30-bb9f-c26e741a2e44",
        "indicator--0bf66409-84c9-47f1-bfb5-705b14a22888",
        "indicator--5be8b23b-688e-4473-a7c0-5ab528793401",
        "indicator--9ae88fec-c87f-473a-920c-ce3e5ba92ff3",
        "indicator--b2d99a23-51b1-4ef9-90f1-22d86424117b",
        "indicator--54364b7c-7cc8-482f-8107-b8162f9250b3",
        "indicator--1937c082-f160-4301-9200-7cd564736055",
        "indicator--81fb6f8f-4f92-4eff-b819-a6b6371aaa6b",
        "indicator--4d50633d-3af9-4da7-ae7f-0729b971a27f",
        "indicator--c37df85d-19fb-442a-9b77-c7971cfc4d59",
        "indicator--9b526510-6f9d-4768-8dbf-8b21d50c87ce",
        "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
        "indicator--2cd98388-4daf-4db9-9dc4-2c929dfacdd9",
        "indicator--b27bbbbd-7f54-44d8-98df-d22c84a3c0c3",
        "indicator--d941e9e7-defa-42df-bb22-3a88ca3de12d",
        "indicator--7bfa793b-6552-486d-bbe5-6c7bd57ada29",
        "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
        "indicator--c2e4cc87-c196-4fe6-883f-663e5a2884f7",
        "indicator--ca1aec5d-e3ee-4b47-89a2-021d35d2e6fa",
        "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
        "indicator--8951b63d-09fc-4566-aec1-3e0f85978d4c",
        "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
        "indicator--c5faa1fb-8e4b-4c64-9180-a4bef32898ef",
        "indicator--745ce08a-7d4b-4836-b5a3-087a5c72ff0d",
        "indicator--79475ebc-ae55-4861-9935-dcc4c74de0bd",
        "indicator--7744ae69-5878-436d-8f21-ff22afe43668",
        "indicator--5fc9c1da-d01e-487a-adf6-d6eb71ab49e9",
        "indicator--1ebbe706-0ac8-4e8a-b1e7-a05c6d6ab87d",
        "indicator--d5313976-cfba-4119-8669-6eba14bda4da",
        "indicator--41c2dc3a-6861-48bb-8acb-99496dea1bd4",
        "indicator--a32a7e40-2b27-4f6d-bccf-ad9bb2ee1a7e",
        "indicator--57ebd0e7-1eb6-4330-8010-2bba60bc3f8f",
        "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
        "indicator--d1734cfe-4774-4755-bb2d-b8df576d0234",
        "indicator--90121ff0-1713-474d-ae60-71260fa0f9bf",
        "indicator--8dacd753-acd2-4344-af32-fbcc47a30b7c",
        "indicator--ac3bbac5-adef-422b-86aa-f55ba3f318d8",
        "indicator--17cff500-b319-4a54-aa05-81d92cf680e5",
        "indicator--1c209b84-0dbb-4907-92b1-ca33eb0ec07f",
        "indicator--61141ba2-ce23-4802-852f-e026b312f911",
        "indicator--587d291a-1b40-474c-80a8-97a4baecd5bf",
        "indicator--cf8f55cb-c9ea-4f44-b276-013a31e7027c",
        "indicator--d930d017-1c78-43b9-be63-d12ee601212c",
        "indicator--e4630e55-e413-488f-969b-f4fcbd121af9",
        "indicator--e1de4e4c-ad20-413b-b823-04026c5848bf",
        "indicator--e81818af-e186-4d9a-bdc1-661c147bb9f6",
        "indicator--c866cd2c-8eb8-44e5-910d-249db5666ef6",
        "indicator--1ec57572-c1fd-4967-b6de-ee1639315e87",
        "indicator--6beb4854-05b1-4550-9905-65bb1a9fee14",
        "indicator--45dfcd05-8d50-42b5-8eca-b600c4177d26",
        "indicator--c195aab6-3004-46fd-865e-546db755439b",
        "indicator--a38519a4-48e9-46b1-8a5e-b9d3cd326935",
        "indicator--607eb93d-f3a7-46b4-9dd8-d6c0448b7528",
        "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
        "indicator--d735ded6-b71f-45bf-b7b0-0c68aec42bd4",
        "indicator--1d9ae13d-dafc-4883-969e-0bef612a50af",
        "indicator--85f95402-fbba-41b1-8211-f8466203df7e",
        "indicator--aa0c3e47-6b15-4a91-bca3-f9b3cbb0e648",
        "indicator--35dfaceb-8262-499e-aa6e-288020c9d810",
        "indicator--70a0ee7a-a43d-4af9-a2e4-40bbadaa1bad",
        "indicator--729668ad-6186-4b30-8aa8-23acfc2529f5",
        "indicator--72e53e55-d477-4f98-a09c-d04dfa15ba8f",
        "indicator--815570dc-14fc-4d7c-92e0-a1ed6c78674b",
        "indicator--5e28106b-1129-47e3-823d-e3cc0965db82",
        "indicator--3b0a9acf-95a2-410e-ae8a-91cd2d86d2c0",
        "indicator--71687d6f-b64b-4788-9a8f-86c57f627a6e",
        "indicator--60777e6c-d963-45ed-a0bc-91a7b01d293f",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--bbe62386-60ed-4c93-92c8-ddb4ea33e1f9",
        "indicator--b54be057-c1fe-4993-a49b-019a698dea4a",
        "indicator--ed63115d-aaf8-4d69-a03c-7d05ea384515",
        "indicator--7047aa9b-2976-4425-9f46-b996f3e2337a",
        "indicator--ecb1a5ee-fca5-4fd1-95c7-653b0c0f2d5e",
        "indicator--b35647b9-fc3f-465a-9dbb-d381228bc05e",
        "indicator--f8a2ebf6-7d6a-4fd0-9e38-e20b5d22a23e",
        "indicator--820a9062-554a-43c7-921c-d289fe84c356",
        "indicator--19ed8bf7-3fc8-4b35-9cb7-74788e1f6b49",
        "indicator--5a61b413-0c31-40f8-8d6c-fc66390ad9cb",
        "indicator--de8c853e-f74d-42e3-bc93-21a5000045af",
        "indicator--cbc23f0a-6773-43b2-8673-721265c6a7f7",
        "indicator--372351e7-971c-413d-b856-977e470641f9",
        "indicator--60460954-7f27-47c3-a626-f7f63e89cb80",
        "indicator--f47159c1-afc3-4493-a657-f12091c9bcb4",
        "indicator--9d28318c-d8e0-4ea4-a03b-c350589d2c95",
        "indicator--ac82624e-f0e2-4abd-8822-cfaeff7be655",
        "indicator--3622e3e2-4ef6-484c-a01c-ddba5f4e5c07",
        "indicator--78329318-c228-4c6b-8445-e017c73c2b86",
        "indicator--2b979fd9-d1a0-4532-97b0-498790f62c33",
        "indicator--1c8db237-cc6d-4c88-a068-f1382fa9faf1",
        "indicator--12118745-1c65-4277-9c5a-fdcd8bf7eca8",
        "indicator--3ad5be59-19a8-4978-99c5-7d29f249e019",
        "indicator--4234a592-36cd-4ac3-9b31-cf1637a93177",
        "indicator--8ab2dc39-afcb-4655-ab50-e0ec23ebc26c",
        "indicator--630544ce-7b19-461e-af3b-33e145e4353f",
        "indicator--1f4a5fb8-0caf-4568-96c6-19a1991e76f4",
        "indicator--166f47e3-8f22-4806-b127-f9eeb354aace",
        "indicator--9e9c70aa-9d58-4c1e-aca3-0c9df43e1479",
        "indicator--6518a6fb-7f7e-42aa-91cc-490301934bc3",
        "indicator--3e05cb9c-51c1-4e53-bd7f-60ba10bbddc5",
        "indicator--2cba5ca7-c8df-4c13-8a75-68bcd3082785",
        "indicator--e88a91e0-6267-402d-a16e-fa09b8a12e79",
        "indicator--58dd287c-6a5d-44c8-8c0a-1cb0d3ce1f76",
        "indicator--47a72300-efce-426c-aded-d2d379ff0ff8",
        "indicator--59a76c72-9b72-43bb-abea-8d9c67e288fa",
        "indicator--2d4bce27-dfd1-4f50-b1d4-407186aa6139",
        "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
        "indicator--d75a13f5-f242-49be-a237-d0553a2d0d80",
        "indicator--443b2be5-f490-41b9-9197-39cb3c9cc646",
        "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
        "indicator--3f893b6d-ee8c-481d-a734-5fe80ba0b835",
        "indicator--7a914c2f-d1fe-48c4-bbdf-21f98d82e648",
        "indicator--b8e9d253-2ce0-4184-ba75-4cc93a74f5f4",
        "indicator--e0c30055-60a1-4ba0-99ca-5a2ebfda29b5",
        "indicator--f29e8e34-b6bb-4e09-b372-2bdd6fca65e5",
        "indicator--0ca99416-12fc-476a-90ae-50e55f702c29",
        "indicator--0fa778ff-e856-4112-a989-33059da1178e",
        "indicator--61bc5898-1e1b-4156-96fb-3099200ffd1b",
        "indicator--00321099-af7d-4ff5-a15b-1a0208a9d736",
        "indicator--037dc04c-fdf7-4ea8-a874-18464bcd10d0",
        "indicator--5659eeb0-b80f-47c1-9804-3c2a8b3b5a3e",
        "indicator--2c768c71-1c3d-457c-9121-764ad488fc97",
        "indicator--a9af326f-a082-4f94-8151-59aaf2740406",
        "indicator--9ba0ecf1-576a-4bac-bd6a-fdd99fa4facb",
        "indicator--0950256a-4ab1-4830-96fa-d743fe4e9df3",
        "indicator--b9c24dfc-7fae-4a66-b76f-cefa672139f5",
        "indicator--f882eb81-99b8-40b0-a298-664d41ede0e8",
        "indicator--eb0dc6be-ddcf-4c1f-97f3-132846a95056",
        "indicator--8eecf478-1103-42c1-9caf-46013778d802",
        "indicator--8f9458c4-8612-4c01-aa34-88c7f85ef6b2",
        "indicator--ceab398a-6ba1-45f3-a23a-443465481d2c",
        "indicator--c4000973-6aa7-4afc-bde0-7e4baa76b79b",
        "indicator--23b6a326-67e5-41a0-afc3-0de2260777a8",
        "indicator--c18f8283-918d-4875-a044-e10f48ab158c",
        "indicator--e7e26056-6230-4807-8535-a6b17f64c441",
        "indicator--a3189e32-2e71-459c-a7cb-dc2feccd308e",
        "indicator--d939658d-271b-4e6c-ad15-11303e3cb95d",
        "indicator--42464042-a62f-4d5f-9b88-ca5678c9c022",
        "indicator--2d7f7430-f76e-45a7-a336-b4b935ac774e",
        "indicator--d5a718a2-baf2-4d63-b351-c9eb64dff4ca",
        "indicator--40dbce63-f7c5-420e-93e9-b7b795f0186c",
        "indicator--3a3a6250-9a22-4f41-a404-5752ba73a8be",
        "indicator--59507f24-aaa6-4392-8760-db41459eb604",
        "indicator--862fc2ff-d946-49fe-8a1d-af4764069672",
        "indicator--c559f470-df9d-47b1-b544-802b11bc8606",
        "indicator--15b07647-c025-4186-ae53-ea42f530b1d8",
        "indicator--888f6c06-5c8a-48b0-8577-4c03ee8d7d20",
        "indicator--2bda168e-aea6-4247-9295-2d8d6f572d41",
        "indicator--2f488169-a4d1-4449-be3b-380fbfff4b50",
        "indicator--61061642-5898-4269-8d87-20bcaee19da3",
        "indicator--e2e48dfc-c496-4cb8-bdff-82450e58051b",
        "indicator--0aef3bb9-1d4b-4706-8f22-10c20cd9fb43",
        "indicator--7ae79a19-74b0-4545-ab29-28589b468ee1",
        "indicator--4495702b-9b27-40b7-a7ca-a17472bc1e7d",
        "indicator--96fa3441-30d1-49f2-bc9c-bc18745072b0",
        "indicator--41a7ab20-5502-466f-b4c9-9679274f7b25",
        "indicator--37ba253c-a90c-4a29-b3e3-e3e73e3723ae",
        "indicator--36987b02-9b9f-4b9e-9c3a-a2b10c1dc427",
        "indicator--5826df55-1684-4dd2-a271-b91e904e454b",
        "indicator--af879de0-c681-4fdb-b260-ad221fb7f78b",
        "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
        "indicator--5164c4b0-0fa2-441c-a742-f717124ffb25",
        "indicator--a51318ac-f4f5-4952-bc19-3ac17cd96ed0",
        "indicator--697fa09a-9651-445b-a6c1-4f47f38e089f",
        "indicator--d6775489-ae85-4d4e-b7e4-e497840327a8",
        "indicator--66e54e36-a8da-409b-94c7-54bb6a5d97d5",
        "indicator--80b39899-cd06-47de-a783-ccf66509ee11",
        "indicator--89a9061e-0e05-4d3c-8a2b-a511cbacc5e7",
        "indicator--3e028fe0-7a37-43e1-a30e-3a43a46ac7c0",
        "indicator--bcd23c97-6dae-428a-a6a7-71407d4aa4fd",
        "indicator--c5e03180-1bb4-45d0-ae0e-3fe85db02a40",
        "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
        "indicator--b971620f-972c-4e93-8c54-90e106fa2e1c",
        "indicator--bbfc5d29-795c-4fa9-b02b-333b4aa60bfd",
        "indicator--e34a9c6d-c94e-468b-911a-ed46cce3a916",
        "indicator--222cac62-331c-4e16-9788-59c3540af115",
        "indicator--ad278eee-cf70-45e1-bb80-c97f35f4dd6e",
        "indicator--f12481a3-e44f-4f14-9363-d556a890660c",
        "indicator--7bcca49e-d9a5-43f6-b66e-45549566c962",
        "indicator--d477bb3c-c919-473f-99b0-a24ea77b79c1",
        "indicator--491ad743-de0d-46b1-b07b-bbe50fe7a512",
        "indicator--086d59f4-61e0-42e0-b835-2906351b97e9",
        "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
        "indicator--423b9d04-ef92-4aef-a3b2-fae5551cec86",
        "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
        "indicator--cf9c5d6e-d93a-4d4c-9135-ef8a258973c9",
        "indicator--b8e27683-7578-4adf-9392-36bc7f71c1b4",
        "indicator--cbf60603-758a-45cd-b367-f8eeeae4e5fb",
        "indicator--fa646202-2512-40ce-aa3a-b51fd5f23809",
        "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
        "indicator--5b214367-8230-46bc-b589-521a79bc3d13",
        "indicator--bd8faca9-2c0b-4996-8d3c-5ed034852f3f",
        "indicator--c8e913d3-453e-47a9-aced-6751d184fb2d",
        "indicator--1b43d2cc-e8a8-4223-adff-76a0505abbbe",
        "indicator--475ac818-bb49-40a3-acfa-67861b4b9156",
        "indicator--584d38fd-103c-48f5-a8ff-6afd390fb06e",
        "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
        "indicator--a4ded840-4db1-4529-abd7-843792b7ca4d",
        "indicator--56ad332b-43a6-4024-9183-88a2d440fa37",
        "indicator--3c8926f6-bc41-4492-881f-24e41946471c",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--5a8b1dd6-5a1e-47f3-b19e-0d03ce2a9494",
        "indicator--abbb9b33-1484-4925-9dff-b971832eb102",
        "indicator--d8553c2b-6442-4c0c-ab5e-9006c1e63492",
        "indicator--0ad9e466-0bdf-4f02-967f-7e1c4f4f7e6d",
        "indicator--a7e1f6fe-255d-4055-8132-ec0b19969bbd",
        "indicator--808ac1df-f2a1-446d-980f-f33dee3de511",
        "indicator--8ca993fe-accf-485b-bfad-1b085da05885",
        "indicator--f5cbb35a-547d-4b46-8818-a0a8b99bd8ca",
        "indicator--a5789ebe-b3d6-4f0c-9ba8-ceece7ec7344",
        "indicator--72ac84cf-773f-4ea6-a636-8f1791cfa58a",
        "indicator--063373f2-1573-4e8e-ae68-b4e4160d5c40",
        "indicator--01db9e4a-fd0b-445c-afd7-15ebac6dee2d",
        "indicator--037bf6f6-676b-4cd2-8d48-22b8c98595b4",
        "indicator--9f4b5a78-b33e-49f2-9653-948adf1837e9",
        "indicator--ef18ff4f-ec06-4e5f-bb14-d4fb6945681d",
        "indicator--b33554c8-5ed8-4b74-ab7c-7534a5eb7731",
        "indicator--e73212b8-2bd7-45d9-b5ea-feb1e9969d85",
        "indicator--a30ce149-bad2-42cc-b0dd-fd85355c8888",
        "indicator--22051bd6-75d3-4aa5-a522-0b491386e66a",
        "indicator--8fd8a558-434b-47b8-8022-11f2532187ef",
        "indicator--8c346d6d-f0b8-4641-bfac-54fbe75539c7",
        "indicator--b7ce0d24-bc4a-4d77-872f-56724c402348",
        "indicator--0049b04e-4aee-4651-b147-6d9d6727cf7e",
        "indicator--c94f60b0-0106-45ea-8797-b77d70aff7a2",
        "indicator--337003d6-58fe-4dd7-9979-7bcae10ef315",
        "indicator--7e433744-efbe-4e2e-ac7f-fd12838772b0",
        "indicator--0b1d7c48-07c6-461a-8a76-32daf18840f8",
        "indicator--003f01be-1622-4330-b726-fc8431990a45",
        "indicator--7ec5b3f5-3406-41f1-b25a-1c2ab23fa8b7",
        "indicator--6935c409-0b00-472b-83a5-5cb0755912a4",
        "indicator--e65f1af7-da7c-47e8-9db7-29fcc4fb82fb",
        "indicator--b026195a-a71b-4a09-839c-f5624d509209",
        "indicator--24fca922-086a-4657-ac97-0df77cfc8553",
        "indicator--8107e2e7-bb47-42dd-adfc-de832a2cb991",
        "indicator--94df255c-3ed2-438a-a160-7c26019930a2",
        "indicator--ccc3b763-de97-4b4e-8e31-56ac7a79b15c",
        "indicator--c95bdd32-79ac-4fb1-b2ef-ea65257980a7",
        "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
        "indicator--45f357c2-d545-4b27-8547-573feaf1d7cf",
        "indicator--ec08038c-0ba2-4885-988b-e1c5512009bf",
        "indicator--00dbf0ff-a962-46e3-b5ad-b14d640baab8",
        "indicator--e0db6bc3-637f-4ff1-bfac-23132cf839dd",
        "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
        "indicator--deca0f17-3c8f-408d-ac9d-a6947d122650",
        "indicator--a25cefec-cf6c-47af-bf92-7648812e1427",
        "indicator--a55de9f1-a273-4122-977c-2fcfb83c25bd",
        "indicator--89de1f94-8e7a-49ae-a1a3-1ec1f51798fc",
        "indicator--ad5f922f-2f47-4244-9068-0e02c84346a8",
        "indicator--1637c448-10f3-45d3-bb42-b60ffc99c71b",
        "indicator--579ff957-5d8c-43ac-9a79-17f16833515c",
        "indicator--3a855a69-39db-4a3c-8a26-577d940ba143",
        "indicator--c8b6fd2c-4539-45f2-867b-2618eab7cd6b",
        "indicator--75888377-6c70-470f-a941-f40336b1e5ed",
        "indicator--6d6f5967-a490-4686-82cb-0a0c9d6602f0",
        "indicator--4275866a-0366-4f06-9d09-a73920387078",
        "indicator--4beaf755-5236-4c2c-a687-887915dff5c3",
        "indicator--6bd2725b-af41-4377-b6f5-1d43b8b9db48",
        "indicator--de42d5f6-f029-469d-91b5-02f5739e212d",
        "indicator--d4dbe4f5-47ef-4ddf-8eb7-bce4f62da548",
        "indicator--c7eb26de-c700-4bdc-992b-223cd076c22a",
        "indicator--5a434db0-2dd8-47b5-ac2b-75baae4afe14",
        "indicator--111fbc77-6388-4bec-bbf9-9f8f6e713f40",
        "indicator--efcf9a90-be4a-4ddc-8709-00729f2924ad",
        "indicator--4ff1a981-c4f7-4fb2-9d80-18061faa4bbf",
        "indicator--120a2b53-3849-4645-8945-f9272b91e848",
        "indicator--1eb22668-b32f-43ac-b32d-e14b1b4ab532",
        "indicator--f62a915d-1390-4cd3-8aa4-bfc6115e199b",
        "indicator--b144f23f-1e94-4f04-81ad-3342ef28fd34",
        "indicator--be177006-69db-4087-b4da-17aaa3afd897",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
        "indicator--cacc92be-4246-4e6e-b42e-9a9b17407671",
        "indicator--43c0d21f-b6ac-4030-8b0e-02ad8e2f2791",
        "indicator--87faeae7-0e57-4bd5-bf79-8c1112ea920f",
        "indicator--0375760b-9b0d-4b4c-a318-aec5c9b1824d",
        "indicator--7a5d14b8-ece0-4ab2-ad0b-357a59944e89",
        "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
        "indicator--42008ee7-a7b3-4d47-98b6-9d751b8b2d05",
        "indicator--d6d4371c-01c8-4692-9ed7-a9b40f2cf052",
        "indicator--15b92027-fba9-42d6-81be-fb3c29fb06eb",
        "indicator--7e8f6048-be0e-4049-bdc6-61191beee7c6",
        "indicator--7a8b7f78-395b-453b-b607-395f62949d4b",
        "indicator--6e01bb22-777c-4b1d-8589-fb09915670ea",
        "indicator--ad55c147-bb61-4bba-8854-4a1c31860a4b",
        "indicator--74432ead-4569-4fa9-a91b-49fe7421283d",
        "indicator--4dbcc8e3-a6b8-4bfb-a7df-77516d36d539",
        "indicator--0eeed96a-f58e-4c61-bbd4-1772c649efad",
        "indicator--eca3f473-bb2c-4c29-8948-14ba01307b6c",
        "indicator--74d4117c-8a89-4ce7-b299-52f33a9419a0",
        "indicator--b35f1435-424a-4782-8cca-fe0560996fae",
        "indicator--d00bcbdc-bf16-49e3-b2dd-eb60d185cd89",
        "indicator--72f700e8-1f22-44d6-a6ec-60ee5f8d9d9b",
        "indicator--ba0d0e8a-0c03-4c0d-b361-02baa5ede85c",
        "indicator--1d161537-1cc4-4cf3-89b7-77279914a060",
        "indicator--fb586071-7661-4ce8-a53d-6ac7457f84ed",
        "indicator--c6700172-0805-4fbc-83a6-e59f5c36adc1",
        "indicator--6777e47a-461d-4a1f-a83f-04da6f325202",
        "indicator--944798ea-70d3-44b4-8f4f-fb82518f9be1",
        "indicator--de3ca551-9fe9-4757-a418-35c278eb9989",
        "indicator--87a3213e-25af-4e21-b067-f874c51a8ac0",
        "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
        "indicator--cdd0ffcb-e68d-4dec-acce-9f9d5b0fce43",
        "indicator--f4ab30ac-c3e2-47b3-b7b2-e6a0de00b0ea",
        "indicator--faea1960-6ae2-401c-8778-4d2158b888b6",
        "indicator--6c45718e-19b0-480c-9c2f-519b668c3581",
        "indicator--b7cf0b04-c137-4499-89eb-a21e8f2cccb2",
        "indicator--95c54c80-27b0-460e-9bd0-0e0c58d497b9",
        "indicator--e29dc1cb-036b-448b-998b-1dc9498b66f0",
        "indicator--5e47744d-71cd-485a-869b-c950e19d256c",
        "indicator--b323199b-20de-40e7-a73c-790991d7b8c0",
        "indicator--1560312f-18a7-4878-afbe-0ac38513e21c",
        "indicator--9263dbcc-c58a-478a-888b-7593e7b6a650",
        "indicator--d6597bb7-cd7b-4152-b93e-8e9248f32004",
        "indicator--6953c798-9c1d-4d2c-a8f6-8a0adb5fdf8c",
        "indicator--be04646b-6c6f-4e15-afb8-1a0d3356681c",
        "indicator--12eaf260-9f9e-44bb-81b2-7c0c4c0a9cbd",
        "indicator--57b554cc-c9ef-40ff-a77f-d0a066143741",
        "indicator--754cde3f-1810-4252-8bf4-5903d84c57ca",
        "indicator--2ee1ec7f-3580-49f0-895f-61e941354f57",
        "indicator--267d931b-ab95-4126-b630-568f3b0acf7b",
        "indicator--ec7a6f7a-9117-471d-9058-82fd2d0b6ff7",
        "indicator--b7a74899-e753-4b38-90fa-e9c489fb95d1",
        "indicator--098aabd6-b86b-466b-aa7d-0e062b385411",
        "indicator--b6bc0b8a-a51c-48be-b08c-2132e069e972",
        "indicator--da4e55ce-1674-4623-9322-bf9beb49fdad",
        "indicator--e35d96e5-4ce7-4ce0-a6a7-0e52748a716d",
        "indicator--1656a18a-ac15-45d4-ada9-c47c44398bf5",
        "indicator--913a907d-94c0-4c7f-84ec-a58f4b370772",
        "indicator--92f829fc-510e-4280-b802-c6c9d0f30a7a",
        "indicator--7e4a4853-1bcb-46c4-b447-75ab9dea407f",
        "indicator--11eee336-340f-4df6-ba50-a8464d0593a5",
        "indicator--3a7c8631-a04d-4b6f-bead-23f21a724ea9",
        "indicator--9c6f72fb-fd34-42bd-87b2-3436e0c8035e",
        "indicator--23ff6d08-ef8c-4576-af32-ef94939ba063",
        "indicator--e40b8e6b-ba12-4211-91e5-c8b7ee0bc5a6",
        "indicator--5c0ae7a1-8fc2-4c24-a3e8-10685b7518f9",
        "indicator--291fac0c-da64-417e-9683-10f5751fcff2",
        "indicator--6cebaf16-1691-4c8c-9820-3cee885ddfb5",
        "indicator--b79f2bc3-1cd2-43a9-a025-f0d6da7b27f7",
        "indicator--2a56b7d1-753c-412b-af2d-ecfcd798fedc",
        "indicator--657605a8-501f-4029-bc59-ae6a35ef679f",
        "indicator--b4131dcb-ce5a-426a-98f6-60bcadc1793d",
        "indicator--f2875ea2-504b-463f-98b2-dfd42c328938",
        "indicator--7dc29108-c3b3-4d15-9b1e-e488b2d19510",
        "indicator--905d6742-721a-430b-a28b-1dea79c0eb3b",
        "indicator--90899434-d377-4f45-9cb5-a4df23bf1e45",
        "indicator--75677e55-2a7d-4c11-a9c7-77b5a168a179",
        "indicator--2be83fb0-0638-4b62-a71f-13123e5744c1",
        "indicator--f93ee57d-318d-425d-bef4-28b3b22ccf82",
        "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
        "indicator--3eed58cc-ee7f-436d-8283-02d894b69b97",
        "indicator--fae62f13-087c-4606-871d-e2af03aa87cd",
        "indicator--abceb5ed-6dae-4047-a40d-4cdfbb4392dd",
        "indicator--62c63aa0-5daf-4e6a-a92b-3390bdbc821e",
        "indicator--75c35b69-8804-48b8-bf78-a92f7aefd337",
        "indicator--c4d874a3-0f0f-4df1-95ab-108ae1d65f55",
        "indicator--3a82dc28-9929-44c8-acce-04f03cc1bf4d",
        "indicator--a2286a3d-dc47-484f-a677-9fcba1d5c9cd",
        "indicator--c20f3ec1-942f-42d3-8e92-c76d6ed449fc",
        "indicator--b11fb7ed-b8cc-4759-9591-d627e0ed27b1",
        "indicator--dc9d76fe-1212-42ef-840d-d826cd375420",
        "indicator--81f963c2-5075-4433-88e9-356671cba817",
        "indicator--a379b40b-faac-4c4f-9d66-50cfb32f4dd0",
        "indicator--c279316e-5dcd-41d1-9fc8-11b90d16014c",
        "indicator--e81cfc86-c791-465e-b5db-05d09ea3859a",
        "indicator--09905267-f0c5-4db2-9495-5b03e85b403c",
        "indicator--ca09eb97-50aa-43d7-989d-7c7bae0947e9",
        "indicator--f02b5344-67dc-45f5-b2a4-3db9fab600ae",
        "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
        "indicator--3d64c3e6-8bd5-492d-950d-33e566480fe0",
        "indicator--c63b49a5-0fca-4fe2-886f-22f94a14235d",
        "indicator--d0591376-9989-4532-a1ed-a4cfb8a0a5a1",
        "indicator--b2752d6f-5751-47d7-acbe-ae8f45567859",
        "indicator--68894c15-fd89-4d5d-8074-a56cb0c3d207",
        "indicator--b3b9b88c-52aa-4609-ad1f-1e5b1f43cef6",
        "indicator--fd0c4b2b-dd0d-4f4d-903b-59071f568323",
        "indicator--a940a6ca-b9a9-44a0-a5e1-0118dabdb390",
        "indicator--c169737a-420f-457a-835e-da0c4a42dfec",
        "indicator--d8823cba-f962-44d8-82f0-163892b8b968",
        "indicator--d3985724-15c7-4df4-8e78-06e5e46e325f",
        "indicator--dabda9fa-e838-455e-9176-8b16fa9bed0f",
        "indicator--85eb0d85-ed01-4aaf-9841-659e44a46987",
        "indicator--f0eaddf1-0cc5-43de-9ffa-b5ee2d67531d",
        "indicator--23355fdd-7290-46f4-831b-ca55e06efd27",
        "indicator--4c2a55e2-f4a4-495b-ac07-05b158fbcc67",
        "indicator--fe8add4d-5784-4e51-a9d6-4e4b171ad5b3",
        "indicator--56102ce5-e2c8-4732-bd8c-bc0fa95df6a9",
        "indicator--d97cfaae-043f-43ab-a42b-19e42ca16c84",
        "indicator--7ca1c572-748d-49bd-986f-be89393192ec",
        "indicator--d77d821f-62c1-48cb-904f-1f532d63861d",
        "indicator--c7817c03-895e-4158-93dd-7908db6194c2",
        "indicator--943cc5a4-5f55-4b76-9a2d-613d17e7e6ee",
        "indicator--07b6b110-3eca-4d19-87d8-77747bbf9901",
        "indicator--798a1a8f-1b72-4c8b-800e-8c15455afc38",
        "indicator--360150f3-dc9a-44fe-a9ef-dac208d45e95",
        "indicator--8d0b92d9-c2ea-4253-840d-a8b38f8ef340",
        "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
        "indicator--89fd0d76-c92b-4747-adb1-e93c02929b1a",
        "indicator--4aa2dcfb-f640-486d-ada9-49347e2c9343",
        "indicator--66c47865-1184-41a5-9814-e6c8a8e7b403",
        "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
        "indicator--63c85f5f-f8f3-470e-86f6-8c5d5e8d4ca7",
        "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
        "indicator--27720235-27d3-4957-a0d2-d843eed19eab",
        "indicator--a7b098e2-bf19-4ba1-88d2-b4099ae759b0",
        "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
        "indicator--39b580bb-1677-49b9-9991-65360781772a",
        "indicator--5645b373-d019-45da-94a8-439f47919e91",
        "indicator--c3bbda8d-6e70-471d-853e-14cc7faf95de",
        "indicator--c5646c53-73e2-4f70-8d4d-d083ddedc8ba",
        "indicator--ed559cfb-bf09-4f8f-974d-13b2503f339c",
        "indicator--1657dd8a-aeaf-4ffd-b253-6ba770f435bf",
        "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
        "indicator--ef90d881-5946-42e1-8149-437c96afe7ba",
        "indicator--793b180a-0ae5-4554-ab4b-14c229df46d4",
        "indicator--7de1d4cc-0c37-4020-9a72-05d61cd8372e",
        "indicator--3ea0fa75-9780-431f-9cfb-77f1686b62a5",
        "indicator--14837275-5f9c-477f-b737-3633191c83d7",
        "indicator--7352feff-91ad-4bf0-82ce-2524933a4092",
        "indicator--50fa8c54-6196-4e46-8e79-dc8f7a168a37",
        "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
        "indicator--95053c99-e110-45f9-b28f-95102538951d",
        "indicator--fb9a7c41-026c-473c-8175-75772b44bb2f",
        "indicator--d718d51e-92df-45ac-942e-da782aa63a5c",
        "indicator--e479a962-6e02-4b74-b560-0b665b0baf4b",
        "indicator--656d2713-5f73-4fbb-ab14-4afce75e01df",
        "indicator--c67de16c-4136-4f86-9996-6ca1da65edb8",
        "indicator--f53ff56b-612b-4dab-a1dd-5d10dff6a94b",
        "indicator--c301a53a-d70c-4524-afd6-ec3ca30514c5",
        "indicator--5d8bbebd-b3f9-4380-8921-9c82603a21cf",
        "indicator--0c4e4b95-9be0-4884-af20-23dc7ad82597",
        "indicator--6c532d10-50cc-40fd-9d37-8a59bf75b4c4",
        "indicator--19fe9573-5fba-4411-8bb7-4ea9dbd46e30",
        "indicator--14b48af7-2323-4c85-a214-d8aa80ab00a1",
        "indicator--8da1356f-4406-4248-ab06-a16261212a72",
        "indicator--4772bec6-5edc-4e44-bf5f-521c7c664e55",
        "indicator--a1eeead4-29be-4e2b-9f21-60c3723a5b88",
        "indicator--c4f59b7b-096f-4ab0-b9d3-00d2ed8291f3",
        "indicator--f69fe1e7-2ec3-4bfd-8a9f-90bf9eb46903",
        "indicator--2c015e09-3d09-4211-9227-56aebdec011e",
        "indicator--ec35dca1-8381-4593-bf02-605127ce2471",
        "indicator--1fbf9b64-f9dc-4072-a1e1-bd674db6c3c8",
        "indicator--919b61de-7bd9-477f-be2e-df1b1d77f8b7",
        "indicator--406bbe5b-a81d-4986-9e37-c7dc4ea1aff9",
        "indicator--f70d4daa-7a48-43f4-9001-9d445bde0e05",
        "indicator--fa2dd6ae-77d3-4934-a6d8-b81afb649638",
        "indicator--9e2be11b-c40d-42f6-8e07-b11ea57c0223",
        "indicator--b6400d11-625e-4761-a8f8-2d5e9422d107",
        "indicator--adace7ec-4009-4d43-9fc8-17b4fe72ede1",
        "indicator--4f547501-a959-443b-b686-59ab8c5d0f83",
        "indicator--ecf41038-89da-4510-b90a-1f5fe53209d3",
        "indicator--514e94fd-9189-4bfe-928b-1e9450372f12",
        "indicator--623b794e-b9ce-4aa3-9739-cd3ebedb4613",
        "indicator--f3cb734e-9ee8-420d-8cbc-dd1a410d615d",
        "indicator--93cfdb26-f02c-40fd-b154-915ff2ad44ef",
        "indicator--9b31e4f7-c28e-4d52-8b0d-68eaf32989f6",
        "indicator--16345b5b-c2db-46a3-9e57-3ef4f707058d",
        "indicator--f5b75eb3-9715-4001-8e88-475a2c91a754",
        "indicator--4d7779c2-68ca-4d70-87ff-9c3c901a6085",
        "indicator--fc2f2fac-8702-4474-a6ba-c5d76b71a7ff",
        "indicator--b22ebf27-2f19-42a3-b662-245ecc314593",
        "indicator--b803ce56-b274-4d92-a12d-98d90873e197",
        "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
        "indicator--0a5d88d7-6184-4d1a-b7ae-4c8db6e6b09b",
        "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
        "indicator--c017f1a0-ccee-4d64-9ca1-58f2132734e7",
        "indicator--dcc2c3b3-49f7-4404-91a5-8ebd2b0869c6",
        "indicator--62669e3a-fce0-450a-b481-83d7c6ded36a",
        "indicator--ca261299-4666-4242-8326-6e11e3c7b13f",
        "indicator--0f86822c-1932-44a5-a424-4a7efa050eea",
        "indicator--cf43a14d-95e3-4f29-bd96-2a623da1f91a",
        "indicator--0c50f2da-a889-4a5c-a31b-66f6a5fcadf6",
        "indicator--5d396cb6-5cc7-4dd9-812b-092499afa344",
        "indicator--5c3a2e8d-167d-434d-8ee9-da9a61661980",
        "indicator--439c502f-126d-4d81-b4a8-d32225c25e4b",
        "indicator--3d9c3f92-61b3-4c31-ad21-89949b4beed5",
        "indicator--3cd7fcb4-dd6f-4a39-b13c-743df49589fc",
        "indicator--d12d4e86-1cd9-4a88-b3ba-1da0268f8d5c",
        "indicator--f3d8f774-95b9-4a7c-814b-3dad888f8fd0",
        "indicator--5adb42fe-6788-4316-84d1-5a04ca56ce89",
        "indicator--b2666e4f-0559-4c00-bcc6-1d171df62946",
        "indicator--8a4edbf8-2b33-4d16-834e-41cc5349788f",
        "indicator--d8794691-efc9-4242-bb28-ba21a06acdb0",
        "indicator--d638fdbd-0fc4-4fed-8514-abab4aae4a8b",
        "indicator--aa3b1496-f830-41c3-8ad4-585d01e15d61",
        "indicator--d04e26dc-151d-4051-ad7d-de93c0ab9c9c",
        "indicator--c73e8381-1b10-4bed-bc94-333646ecb29a",
        "indicator--30df0d5c-880f-4152-b440-1bd176101fc9",
        "indicator--2e8715d6-7967-4bc4-9a3b-94890025ea20",
        "indicator--8031065b-d71d-4a69-9408-fc617520e804",
        "indicator--539fb048-e483-4db0-a48d-97ef7eaff5b9",
        "indicator--921ab20e-6360-4e6d-a81e-c8590fcaaf3f",
        "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
        "indicator--42cfecac-491a-4c9f-bbed-2c7785c4e537",
        "indicator--a385fd64-8b2d-4ee9-b62f-8079df2de642",
        "indicator--97592a40-5555-47d5-bcc3-da64b77b7f62",
        "indicator--ed4b21d1-1008-4f74-8839-4cbb54ef9fb7",
        "indicator--b18579c3-eb08-42db-bae2-55d5bdec871a",
        "indicator--3c73eb3b-2898-4496-a200-d28441276056",
        "indicator--c5d6d550-4737-48e3-a334-2ca5e3974058",
        "indicator--ebb37a87-b16a-4c64-a690-6c0470d965d8",
        "indicator--ef76177f-609f-4388-91c5-76cab2555938",
        "indicator--0b2e6bda-40ea-43ab-a5e6-9fab7906ed6d",
        "indicator--e9fbc22c-eb9b-4666-9879-2af603115115",
        "indicator--0e20cb2a-bc27-4209-9f7d-48be77daa409",
        "indicator--1a554af7-907a-422e-b975-175498553b47",
        "indicator--c263548b-e1a2-4e43-8b0a-06e30f6327cb",
        "indicator--ea92a6cf-c511-4645-bcd2-09bbc69784a2",
        "indicator--2b3ef461-a30e-47b8-bb10-f0752e4eac3d",
        "indicator--78dddcfd-e75f-417f-be19-4588f7bf1e86",
        "indicator--f29244ce-d35a-466c-8a7b-78495c01db4a",
        "indicator--8339f25d-0574-4407-8b7c-54a226a5259c",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--20c7c16b-4303-4693-a7d6-59de81d26cfc",
        "indicator--ae946b84-0ee1-4dd7-a4a2-7611efa3fe80",
        "indicator--34ffab96-a553-4109-a246-59868ca0d3dc",
        "indicator--186058c2-25f5-4de9-9955-7de35b80e68c",
        "indicator--e392ce38-50f6-4dcc-babf-593f1712a1cc",
        "indicator--8a68c7bc-0806-4ceb-9056-b1b20ff1fe87",
        "indicator--8ca281ef-f275-4407-8bab-4e0502935d6b",
        "indicator--d955236b-a124-4e37-ab75-b9ea314670e1",
        "indicator--e94c1646-b7e9-47bb-9389-f111ec9a22c8",
        "indicator--b30da21a-858d-4819-8bd7-e035a4faf876",
        "indicator--49165f62-3769-43d6-a1f5-0bf983138f3d",
        "indicator--5bb8df17-f464-4485-950d-10a17de8ddcb",
        "indicator--af0e55c1-96a9-41f7-82ea-e9f9a79af0d0",
        "indicator--91e275e7-bae7-4688-bf29-0bb1df517b2f",
        "indicator--0e64c170-528a-48c5-84ae-2f098316c608",
        "indicator--d60b98a1-464e-497b-8e53-865b911fcfe1",
        "indicator--3e858f50-c996-4127-904f-833c351fef1e",
        "indicator--26046a71-8a61-45df-9908-df2694d972f6",
        "indicator--d3b15994-e674-49bc-b8ff-234ab5096858",
        "indicator--ed0cc409-bbd4-4923-a844-a525cf3e790e",
        "indicator--05e89785-9259-4965-a22c-d7c701cc8664",
        "indicator--bbb6b8ff-7054-4a60-996f-ba1ed736fb07",
        "indicator--e476c3c2-33c9-4876-962a-e9061b4f2afc",
        "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
        "indicator--4cafa6cf-c4c6-4b1b-8b97-8999b5251847",
        "indicator--1e9a1216-c81e-47c2-a1c1-c7e16b4762b7",
        "indicator--1ceb3fc2-fe99-47c1-aa4f-61cb61647f52",
        "indicator--ae6bd4a7-ad7f-456e-9fb3-f8764599e72f",
        "indicator--d80d1110-d993-4963-a677-7d2c2634e10e",
        "indicator--dd4e3175-8ae9-4f68-a6a4-368bc9f733d2",
        "indicator--ce0dcd07-cb30-49a4-8fca-d78e9745ed63",
        "indicator--7baa5176-c9f3-4a40-89d6-8bbabcf1a4fb",
        "indicator--aa494324-c992-4f15-9f85-1e1d558609ad",
        "indicator--19a82604-8e18-4415-a1b0-0349ad0444a0",
        "indicator--d8eaedd1-99a1-40a7-8613-83df12395a54",
        "indicator--296e68f5-843f-4cfd-9eb0-df22771e1d60",
        "indicator--c644a39b-600b-4e15-bc16-b070daa4197b",
        "indicator--551b7c9f-e8fa-475a-a368-0c0c9f200354",
        "indicator--4d5b6bc7-aa3d-440b-8f0f-7363431b45d8",
        "indicator--774aa0eb-41c5-442b-8629-275bc1cf47c8",
        "indicator--9b4a9045-bc06-4dd2-a11d-071da99a75a1",
        "indicator--e6274d22-66f3-4193-b58a-9e84f9ea2b31",
        "indicator--b25bf906-65df-4079-92ba-25e4b3fe68cd",
        "indicator--4bb4819a-7264-426b-bc52-e4dafc98e0fc",
        "indicator--31cbfd69-a94d-4ff7-9578-1193f3dcde18",
        "indicator--c33b588a-7cb4-47fc-9e17-333ae2e923fa",
        "indicator--9428d7fb-5122-446d-84be-3ff207833085",
        "indicator--28be2b1a-c473-4456-ad98-54e1e87848b6",
        "indicator--b83c4bc2-ac81-4979-bd43-385c942d8e2c",
        "indicator--3b292bb3-b638-4e60-8c28-b430cee14698",
        "indicator--e14f9985-335b-4fe9-b470-cbbe0866a6d3",
        "indicator--7b0a3821-854b-4c80-94b8-b67ce448e22a",
        "indicator--0c61f5a4-e10b-4288-a847-2117febc1d68",
        "indicator--3adc453d-28e4-45fe-b0f5-816ae359a50b",
        "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
        "indicator--e132bc1b-6557-4d91-b75e-64ca446e4c06",
        "indicator--786d0c5a-94c2-4eff-a989-5435bcfc8a1f",
        "indicator--be6329e4-9fd4-4bcc-b4d2-8824e4e69d92",
        "indicator--b02cb950-460a-4b73-8505-3f13ef82d5fb",
        "indicator--ebca6ae7-f64d-4c49-90a3-6bd78efe8f9a",
        "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
        "indicator--195d2148-9f39-49b3-8af9-625b03efa949",
        "indicator--55d820a1-a7ee-476f-9b6e-4a97b885eef0",
        "indicator--83a8f763-aae2-45aa-9ef3-2cc0ee069e89",
        "indicator--222d9b2d-acca-4e85-8630-80edeeb1b13d",
        "indicator--b735b81a-8096-41e6-937d-2b5880726c3d",
        "indicator--cab4d5f3-9225-4e41-8fd7-541991c9d14c",
        "indicator--33db4ef9-f429-4d2b-a117-4fc578998dd1",
        "indicator--fa9bd514-8a69-4bf9-883f-9586f3900269",
        "indicator--aac46888-d773-429a-bc87-52f90f881024",
        "indicator--2758fb09-eb83-410e-8565-4458dd89f253",
        "indicator--13acdaba-7485-40a4-b5ab-397493937ed5",
        "indicator--c0d6c10c-87eb-4880-9424-6f439796f71f",
        "indicator--a5a315a7-a4e8-4eb9-9f69-9b1ee7a08cf0",
        "indicator--d01eef29-a8b2-4a62-9e2a-87b46b9d453f",
        "indicator--34f2c689-c735-4afc-893b-1fd7742fcdc5",
        "indicator--32e88b7d-5f08-4820-8b6a-f82a3d525f34",
        "indicator--60d38d3e-c1c0-4e1e-abfd-e9417c598517",
        "indicator--32b01d9e-2862-4b81-9fef-fc9a4d1039be",
        "indicator--f6de97dd-db08-4423-834a-9d759943f586",
        "indicator--e2428eab-0542-495a-addd-c3f1cf8c8257",
        "indicator--8c13df84-68bb-4c09-bfd1-b7cfeaf0e8d0",
        "indicator--052ce853-9b36-40cc-9941-5e6a5fab20b5",
        "indicator--dee5f18d-7015-43ef-ae7d-a5f39f105268",
        "indicator--2f2f8a2e-1a78-475f-8282-f78f02493893",
        "indicator--eb998234-edeb-4e10-885f-4b2d87ee7665",
        "indicator--e5168cf9-5429-451e-9d9c-1b13c43e6371",
        "indicator--fd9b98db-6c32-4aa5-bccd-ae645eef6995",
        "indicator--3240a201-0162-464a-ba4b-d4e1ede7c940",
        "indicator--591127f8-1805-401f-9fbc-11688fea66c6",
        "indicator--072133d1-2370-4451-b993-6d4aa96b119f",
        "indicator--1dcd20c2-edca-4f77-ba79-e3b8a87e66cf",
        "indicator--82dfa518-512d-40e2-b33b-49c7a58969b8",
        "indicator--21837fbe-0c13-49ba-8858-768df3a7eb68",
        "indicator--7d42f5ff-ce33-4c55-adea-b1ade40e07f3",
        "indicator--1d232ca8-16da-42ef-a66d-da6f38e7b655",
        "indicator--5fc2451a-96e5-4f7f-bb1a-02e7c416e4fd",
        "indicator--9e1fef11-dd1f-41d1-8c11-eae1813c555d",
        "indicator--00af173a-be02-4727-9f32-7fee614c50af",
        "indicator--4077f294-2b00-432c-9d30-ed0acb56b856",
        "indicator--65ddd3bb-5c69-4d32-8dad-d3889ed931c5",
        "indicator--13ea094f-d521-47cc-b11e-86ee7ed47634",
        "indicator--15448fff-0074-4299-9141-4f07b189b47c",
        "indicator--1c8c022b-a1aa-4456-a272-614576784f47",
        "indicator--10154dcb-9b02-422c-817c-bae807da6f5d",
        "indicator--d63a573f-7094-40e2-a56e-168ea6e30f7b",
        "indicator--3dbdd90b-3316-4aae-bc12-4846ab23d24f",
        "indicator--f5f2ec32-4dcf-44e9-a15c-35d13c78a347",
        "indicator--4cf5a7e4-7db3-4843-bfa8-cdd8a69a53da",
        "indicator--a6cd1cee-787a-4d06-8e2a-2069a8b20b00",
        "indicator--db525e61-c7b6-4121-ad01-23e2ff6385d9",
        "indicator--30ed341e-8dd7-4abb-af1b-fdce3b5b0636",
        "indicator--888c83bb-8982-4430-b3a5-3b14f8bbbfba",
        "indicator--6278b9b2-966c-45ce-8e99-6e34499bb813",
        "indicator--dedc4173-ff5b-4ea5-b65c-10f24ebc5842",
        "indicator--2f384e0d-2f04-45ab-a266-bad286d88a27",
        "indicator--28fb221f-9eab-4245-9ee9-a1f6938d905e",
        "indicator--bdf59664-f1d2-4365-a638-7fa15e288092",
        "indicator--25fb015d-797c-4192-9a99-531d9c514e27",
        "indicator--c97a308b-3f2e-412f-9a2a-ed08540b11ed",
        "indicator--a99946ea-18dd-43a3-b06c-a6c8bbb8f5eb",
        "indicator--85c388fb-0cca-49b1-98d1-fc7f39d33e28",
        "indicator--40c5c937-f1eb-4b7a-9df1-690c934f64e4",
        "indicator--a0e8e009-96a7-4ea4-8af0-907c0b4f536c",
        "indicator--6fe668de-e1c4-41dc-b931-6b6d15e15ded",
        "indicator--da38092f-0c08-49bf-aeda-d91cf9d6ee60",
        "indicator--f5fcd9a4-ae00-47e5-9d68-f4a982b7a7dd",
        "indicator--04a8f3f5-c1d5-45b2-a2ca-802b7b7aae35",
        "indicator--f4725a00-f325-414c-9e8c-573807dfb8fb",
        "indicator--b07e2bca-1a9f-40b5-8772-0d80e9138610",
        "indicator--a5b76747-1b36-4617-bf6a-972dd22ae07a",
        "indicator--e5f8123a-9118-4541-90a8-64357ce444fe",
        "indicator--c1b6fa27-9e1b-485a-bc2f-4212574443c8",
        "indicator--023ed1db-c29b-4d08-b650-af6b0a8d8e25",
        "indicator--e3698796-0c26-4dc4-bed6-c7ec73e38aa8",
        "indicator--f722be6d-b2c1-4054-be36-de478b441f66",
        "indicator--ec7f1669-36e9-4058-8f8d-801eb47af124",
        "indicator--d5678bf1-01bb-4d55-88bf-5a30be8fd911",
        "indicator--aa0c689f-cf91-4af5-9dc8-a2ec35fef82b",
        "indicator--88a85f84-7645-4730-bbcf-027997861c9e",
        "indicator--86e4f4de-ab98-491d-8f07-47d154936dde",
        "indicator--25ecded5-54c7-4ab2-b2b9-af82abe1b169",
        "indicator--4ce42abb-b33b-4779-8da0-965150851938",
        "indicator--6bc6546d-5400-4346-9060-860d0f9f00bf",
        "indicator--f82ce247-e5a4-4fcd-8ab4-99b9a2d959fe",
        "indicator--04241a3d-163f-4d3b-831e-c056bd8467e9",
        "indicator--ec397f1c-255c-40a3-a9c5-5de3cb545cbf",
        "indicator--bf32216e-0d68-45ef-999a-c23d1bb4f04b",
        "indicator--4e9309a9-e9f1-4f82-b450-43d4e248ee25",
        "indicator--77f6c922-dcec-485a-bbec-3f7721fe9caf",
        "indicator--628303e4-5582-4995-8d85-c0a01c2fa49e",
        "indicator--0e8d669f-be8a-4524-aa99-03b60d0dbd7b",
        "indicator--1e7258b1-0795-46db-b767-c81e5b039615",
        "indicator--1df86651-e304-4841-a963-c41b310bc9b7",
        "indicator--58190f8f-1f6c-428a-aacd-9c32a24ef51b",
        "indicator--2086e90e-2e66-48f4-9ae7-6e8315ac921b",
        "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
        "indicator--b7241e1b-d68d-4955-8f84-8770d8b3cb8b",
        "indicator--65df4e03-92f9-4e39-a2cb-7807d45497c8",
        "indicator--00155eb3-a736-4c9e-92ae-f1d6f9a46a22",
        "indicator--d8e2ebbc-28c3-4464-b49f-bbb054edec07",
        "indicator--a900aceb-7be8-4091-8f90-dc366247d001",
        "indicator--3763d167-a835-4c7c-8bb0-5486cf4212b2",
        "indicator--4e9cf072-39d7-4b5f-b5c4-ee3746b1079a",
        "indicator--56e3b373-5b41-42e3-b289-477bbbe33ea5",
        "indicator--a3e5a7eb-4406-44be-960a-e945b36d82d3",
        "indicator--21a9277b-f6c4-4a73-a707-825d1b5ab9b6",
        "indicator--c1ac1963-15b5-4524-b948-b0c7c018e270",
        "indicator--439dacf9-3165-4d01-a795-37b7079824d6",
        "indicator--da3108b5-1dc1-40f6-9416-9e2613c0deef",
        "indicator--433b7059-b4fc-4bf0-96e5-7c43af56c33a",
        "indicator--9401123c-f2a5-491f-b273-e7643e4b1329",
        "indicator--f823dc23-a606-429c-865c-d2e671ed691b",
        "indicator--6ac35cca-0212-42fd-9add-67cf2fc925ac",
        "indicator--4265268a-d1f9-475c-aad1-b5d5c0db8a28",
        "indicator--32208822-79aa-4e95-ac27-4fa86b9b8055",
        "indicator--e03edadb-3f9a-4960-a700-40dd01c87bf3",
        "indicator--748beb0a-9bee-481e-8ebd-21ffc76dab9a",
        "indicator--dd1ce91b-6ac5-4ecb-80b2-35dcf87857f6",
        "indicator--89657540-e5fc-4e11-9ce3-adfe3a80f787",
        "indicator--a94c6499-25b1-4ec0-aa5f-9a3b4bc68f74",
        "indicator--f9430072-5690-4cd4-a04f-0f7b892f66a8",
        "indicator--10e640e5-de14-4049-a678-80131c952cba",
        "indicator--9fbde65e-c8b8-4877-85d5-038d5c480791",
        "indicator--5a91cdc5-a6c0-4609-ab40-507298b0de20",
        "indicator--564be129-336d-4b60-b29e-c02a58cdc0cb",
        "indicator--fcb0f6f3-99ec-4b67-a152-d84f94d15be9",
        "indicator--6bbd2e41-79d3-49d3-a192-9484680b78b0",
        "indicator--a815246e-ead9-4ae0-9a28-d6e8ac8a2e6c",
        "indicator--f729bab4-e266-4d50-b554-644544c9c95a",
        "indicator--1d701c47-2758-4d80-8351-20b1182ca412",
        "indicator--f5b456fd-7d8a-479d-bf3f-666344cb794f",
        "indicator--df1c5e2c-0897-4c72-976b-3f357fa4dcce",
        "indicator--f570560c-0b3c-40bf-afdc-9e627770dc4c",
        "indicator--c65d83c7-13b7-440d-8350-dabdf4dfce22",
        "indicator--f42df1b1-ab19-4b20-b22a-b76d268b4b38",
        "indicator--8e7d6e11-7741-4960-a79e-2a3a47ffeec1",
        "indicator--f9f56be3-0648-4c66-bea3-f4a921a1b6ac",
        "indicator--2c1e00e0-aff9-4884-83d4-d67e26a0910e",
        "indicator--38dd82d4-182b-4331-9973-eb34fc022882",
        "indicator--76088751-3d57-48a0-b2c2-c311c0e9c1b3",
        "indicator--065cd1ad-d83c-44db-81c1-a4f961137517",
        "indicator--036077e2-a5ca-4e5c-ae01-fd8a548c42d6",
        "indicator--e9750fe3-d171-4a7b-a5d0-fd264459f991",
        "indicator--79bcf8db-4605-4c86-b914-d46ac37831c7",
        "indicator--43429236-ec89-4b29-a3ed-15d99096755b",
        "indicator--2554ad19-c3da-4288-b416-ed9c5c33885b",
        "indicator--d61f117b-0641-4b20-82e9-2a2a698e3c02",
        "indicator--26ae36c2-b38c-42a8-9aa0-ed8263d71318",
        "indicator--6b58eaa3-b8c9-4d13-bc53-284a65b84b46",
        "indicator--557b7188-fa5f-41cb-a429-fcc16d92c593",
        "indicator--47817b63-90c9-44f0-a9f1-f4d040d03a97",
        "indicator--dba8937e-c4fe-45ec-8bca-0e2d96e3920b",
        "indicator--b81bbb83-903f-4a86-a26f-0efd545b0738",
        "indicator--75d86fa0-df97-4eaa-8416-44169366af7c",
        "indicator--c9232b0e-cb36-43a6-a116-9c7bd6c39c04",
        "indicator--4c6cdbc8-a164-4dcf-a731-377acf8050e0",
        "indicator--0881cf67-6106-4714-988e-cab0d39458b0",
        "indicator--755ff90e-ffda-4469-94eb-dec279f5fbe5",
        "indicator--d88697a6-386c-4b06-bbf2-d3fb30847576",
        "indicator--7a971010-dca9-462f-a612-86aefb9bf516",
        "indicator--8f9ac43d-380f-4897-b111-cbe1781274d4",
        "indicator--76c53a45-ec26-4768-89dc-d7684bf1a9ed",
        "indicator--a5371959-8091-4b77-80a7-6aa5c8ace4a5",
        "indicator--25c682f3-8439-4a1b-aa62-7ede3554ae37",
        "indicator--e0b78bd4-9800-4659-aa8e-f2a8c6403e51",
        "indicator--865a2aea-5a73-43e5-ae30-6c34f703ca0d",
        "indicator--3ac5a14d-9380-4ac8-9092-2c6ea7f8cf9c",
        "indicator--690f43a8-e786-4914-bc2a-50f571515240",
        "indicator--982192ae-d0ca-4883-ba4d-8fb848651bac",
        "indicator--937068d3-83d1-4f01-bffb-57e2fd10bf47",
        "indicator--2d9c1ac1-0a76-4fed-9758-a12d744c360f",
        "indicator--473bba35-e583-436f-9607-35f0f64c2560",
        "indicator--1f19c6c1-3930-48fe-ae00-818c87ecef3e",
        "indicator--13f45681-62d8-4b26-9297-2a9179359c0d",
        "indicator--41d15914-e07d-441f-b748-eac16eaeae1e",
        "indicator--b5dedb54-337a-42ff-ada6-34fa0078647c",
        "indicator--4b22e9b2-515d-4e59-9373-1942fe165229",
        "indicator--57bcb545-fe58-487c-9589-80cfb6422a74",
        "indicator--8e84396c-3f5f-4ff6-b0a1-f4000bbe5674",
        "indicator--8678cae4-fbff-41d1-a507-9520774612eb",
        "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
        "indicator--cb898d42-8274-4ffa-a292-614f38ecb0d6",
        "indicator--3751ecb5-3298-4334-8b56-ceff90affe7e",
        "indicator--c6bedf9e-2ed9-440c-bbd3-574f0bebe9de",
        "indicator--ce53681f-2f48-4a21-a107-338668c396a5",
        "indicator--e5d4fb3e-78a2-4abe-80b4-1fd7b42bd618",
        "indicator--d27c22fd-6a0f-4a0f-a899-27029d4dfa57",
        "indicator--46407f86-6546-47a1-a3a0-29b3d1f6018b",
        "indicator--f79e0a28-f34c-4639-8847-a896509ffb10",
        "indicator--5c71cfef-e3da-4a02-91cf-779cc21ea029",
        "indicator--ff901c09-7374-452c-80af-e554ae9019dc",
        "indicator--d7f3ceb6-2e25-4eaf-87cd-b345cb129140",
        "indicator--0cde8c2b-a5d3-4e2b-babd-64de02851c7f",
        "indicator--bba6572a-1ff2-4cec-9bdd-565226d8ecea",
        "indicator--373e0828-e499-4e54-a090-fbc69356e601",
        "indicator--f99c5635-6835-4cc1-b049-3daa8789a449",
        "indicator--d0045fdc-ba52-45bb-b728-bcb8eebede96",
        "indicator--df500ee2-c20d-4d38-81d6-7a857ce4f9fe",
        "indicator--b74172d0-f828-445e-9012-7874210c64a2",
        "indicator--ce7f8471-73b9-44f1-b235-49000d0d1479",
        "indicator--f9d622cd-1e6a-4790-b2cf-140c89c7914c",
        "indicator--a1c54fb6-3412-43e5-83e9-74ad89b1ca7c",
        "indicator--a3ba60ec-9371-42d4-b520-8d88f63217d1",
        "indicator--a2d6e53a-ef0f-49aa-8fcb-4611a99fc02e",
        "indicator--07f93adc-ff4a-405c-995f-6d924bfb4c0f",
        "indicator--8c6f19c6-ea0f-4fd4-80d0-3924fe678545",
        "indicator--2000f64e-b9c2-4ce8-b228-57c5bbb69a9e",
        "indicator--ac93d83d-d316-4c3e-8020-f2ba08831460",
        "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
        "indicator--9c3b5cfd-a524-4f69-8e1e-f2637dc07cf9",
        "indicator--5bbdb0c9-c019-4676-947b-f9076ffb9fbc",
        "indicator--8c4f6776-1b92-4d77-9db9-fdcc263b267a",
        "indicator--8abfc61a-f7e3-4230-a985-7b8a9d78ff4b",
        "indicator--825e3579-42df-4072-8d62-3fc58c58b9d4",
        "indicator--e0211bbe-a243-490a-a0ee-9adcf9d1017b",
        "indicator--1852ff23-1c69-4be1-bd19-fc0df0dc6769",
        "indicator--b8b3312c-7d6c-45a6-8471-803d7244ea04",
        "indicator--6f6c9ef8-b7ea-4b19-875d-0e3576e93a60",
        "indicator--75dff00f-72c4-44d7-9887-7228de34b441",
        "indicator--a2cfc45f-b105-4663-a7df-630229ee3213",
        "indicator--74ebf0f7-5349-407b-ad8b-c199ff6c16ed",
        "indicator--bd7a4930-8414-43a9-8c57-8da2fd504c66",
        "indicator--17cbc85f-5b51-4f3d-a680-befa9ab24ca7",
        "indicator--b1403e2f-9ebf-4e9a-a8e2-1c3ae994d4a1",
        "indicator--423fb5e9-6cdc-4783-b5cd-b4287a8e74dc",
        "indicator--ade465b2-4b33-4f96-ba84-7a491a769b8a",
        "indicator--3f690731-00d5-4a1e-873a-f854d200c5cb",
        "indicator--278342e9-7190-4965-bf77-d22575f3e694",
        "indicator--cfdf913e-b319-4348-ad95-5c1366a97746",
        "indicator--97c04b59-95bf-4f6c-b38b-55d9f86c7ca8",
        "indicator--51b20f52-ba8e-4e46-8ed9-a2a1b8ddf0b7",
        "indicator--dc1366d4-bee3-4b37-b2d0-fcab7cf99085",
        "indicator--c2f65c96-0b0f-4dc0-a649-0e6c14b13b9c",
        "indicator--ec58d380-8fce-42dd-b437-92e34ccd1015",
        "indicator--db61dc84-2d6f-43de-ade5-876bd2df5f81",
        "indicator--2ef4abf6-8e38-4ae3-aefd-f146d0e47025",
        "indicator--9c1f4075-d964-4037-97ff-d9471361663d",
        "indicator--cabdd4d5-7291-445c-ab97-e822e2462f2d",
        "indicator--9137d497-3579-4199-944f-2ab188e346a6",
        "indicator--f287d190-eefb-448a-b51c-c066d62b55fb",
        "indicator--9f7900b5-3c4d-4a45-9771-a0a2419fb567",
        "indicator--278e258c-926e-4654-8e2b-0012d03ec97b",
        "indicator--7e293ef4-3adc-47b8-8d29-40eec80f434a",
        "indicator--fea988fb-0aff-41bb-ab6e-d3d9e1c446f6",
        "indicator--e508db47-d8b3-4e37-a501-f142de0ba551",
        "indicator--e16ecd30-a6e4-4fca-b680-10817ffe433a",
        "indicator--8d8fddfe-e876-490e-82b2-bcbf0785c89e",
        "indicator--4653caf7-fa8e-4238-beb1-8a8aa51261d2",
        "indicator--1b35d543-15aa-4c7c-a0ef-814db9f16b59",
        "indicator--058292be-ddf4-436f-bcbe-170235099f4c",
        "indicator--0a494757-effd-4064-a918-c18743c4cf2f",
        "indicator--56484017-8c41-4c54-8d07-0fabaac06daa",
        "indicator--4c698809-89e9-4d24-b6b0-9a06b9b564d7",
        "indicator--e02c5220-5d9d-4f07-9264-b862b5c05861",
        "indicator--4a459658-68bd-40c0-b448-6b8b618a204b",
        "indicator--19d20a68-5199-4274-b802-0c0be3729418",
        "indicator--f0a2b573-95a3-4823-b7cc-0718d01533e0",
        "indicator--6c04c38f-308a-42fd-9d41-5df8b6d5c305",
        "indicator--2c4d2b3a-7f4e-4710-aa5e-d5835274f5e6",
        "indicator--dec52ba8-de5c-4f3a-a9bb-46bb893a8351",
        "indicator--3806248f-fa9c-454a-95d2-157063319caf",
        "indicator--7fc844c6-61c2-414c-97dd-8d2029eb9229",
        "indicator--a08c5aeb-6dfc-4d20-aefb-d06acc91ff9c",
        "indicator--2aa5574a-99f8-4617-9811-096e71d37fab",
        "indicator--1019b30b-e95c-43ca-9512-21a6846d952b",
        "indicator--58690ba9-be0f-4733-a836-e42dbb166bbf",
        "indicator--c0bfebfd-dd87-4ab9-9f35-d517a09dc465",
        "indicator--f28bd64f-4d6e-489f-98f8-e80531adcf7d",
        "indicator--47f14128-36cf-4d53-bac7-0efcd079d834",
        "indicator--85412b57-4222-49e0-9cce-33ed9b8075d7",
        "indicator--b86ed45c-3c34-4b25-aaa7-b36487656de8",
        "indicator--51e94c2c-f29a-495b-9f49-b58b900a9b9d",
        "indicator--8828168a-0153-4595-8d25-32b3fb439d0b",
        "indicator--431024e3-9f33-46b4-af0e-414e6153f416",
        "indicator--939d1314-34f5-4f21-bca7-55c51089b93b",
        "indicator--57d29e60-2a87-4c3b-aa53-632379a4f467",
        "indicator--a1c185a4-9b9f-410f-95a6-6bdc9b1aecbf",
        "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
        "indicator--c3d68b75-4b68-4ad8-8de5-54454a2a168a",
        "indicator--0072c4c6-b5a2-4508-9ea7-c2f49a0ce8b1",
        "indicator--a6fa2b22-aafc-4d56-8271-d01f8a55f55b",
        "indicator--809b7faa-337d-4e8e-a83b-3cfacb0115d6",
        "indicator--2b11effe-e251-4f68-a594-220f653d4961",
        "indicator--69ecbf83-f14c-4955-b396-2769d2792624",
        "indicator--e0a1b33c-eae5-4c68-8837-7d1fbe835011",
        "indicator--bc4d0564-4315-4721-b263-7be5fa6904db",
        "indicator--02bad0e6-826a-48da-bf96-dab59fe2db77",
        "indicator--2822d9ae-c1ba-4a77-84c6-f0ea2899eb7a",
        "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
        "indicator--9d9fef45-3cab-44b1-bd23-927a7a74f1a9",
        "indicator--a48c6984-30bf-41c1-ab1a-5c206c494747",
        "indicator--6f625b72-ea2c-4b6e-a678-1d7e20eac838",
        "indicator--1698bae8-1a3e-4515-a33b-0d088efacc5e",
        "indicator--bef708f8-fc3f-40e4-a303-eb060bc1986f",
        "indicator--513a4b25-9faa-4c60-8501-764df5580dcd",
        "indicator--917ffdda-f02a-4231-870f-cece02c98050",
        "indicator--214c327c-ebf7-48e1-9460-6fecbfd6606c",
        "indicator--2b4bbf59-12a0-4551-b218-2cf33d266b14",
        "indicator--a82e98b4-06c7-477c-8fe1-fa540bcf1cb2",
        "indicator--4b7ea520-9cb9-4036-9738-3b1574c21490",
        "indicator--53ab3be4-83db-4352-be9b-450ffd52b244",
        "indicator--e56f3e30-73c2-4a1a-9407-cb8597cf5a39",
        "indicator--6b486f5d-8423-40db-b22f-5044e91498c5",
        "indicator--2bd0aca3-89dc-4db4-a92d-acfc735d5849",
        "indicator--d30cb2df-b656-405b-9002-e6f796a8bb02",
        "indicator--409b7e88-af8c-4075-8179-62492ba1b5b7",
        "indicator--0b53df44-c7d9-4c71-8966-4ea0b513c40a",
        "indicator--2d2a464d-ab91-413f-b5e5-15dbc08a3314",
        "indicator--bb1e7f2c-ffed-4639-801f-3d7098b49c4b",
        "indicator--97231a8c-1bf0-4138-8352-c87225a1eb56",
        "indicator--4cc28b83-054c-43bb-8425-a39929272be4",
        "indicator--3e35c285-e0ab-4a98-875b-7e82cb297bd4",
        "indicator--5cc299d2-d9e4-4ce0-af20-d5856c91ab7f",
        "indicator--f8b444d4-b913-4a66-8e22-ffa7edf0e4b1",
        "indicator--9d346f77-f266-4796-b96c-9edf431b555c",
        "indicator--a8951c50-8414-4e6e-a7ed-8754d96195d1",
        "indicator--121668fb-fe31-414a-b36a-b6e639c6ac62",
        "indicator--6ff07a62-0a51-4ebd-9556-7992365a72aa",
        "indicator--62ee34e9-5005-42d8-906a-a6873a553207",
        "indicator--e193974f-d90c-4657-a506-030dc5760caf",
        "indicator--c01605da-2d42-4a51-b1dc-2502fd7a5ebc",
        "indicator--42dcd791-024b-4dcd-a590-41e60c9709cd",
        "indicator--d3679707-cc4a-4545-8887-a3ae367a4adc",
        "indicator--6afd6d03-a464-40bb-b9b3-6bcaa5084595",
        "indicator--84472559-e922-4592-b5fd-59ed99ff1647",
        "indicator--fa08a2a2-89d3-4c56-a2cd-ece575ecbc07",
        "indicator--cacb33a4-73ed-4a49-987d-7b76742ab582",
        "indicator--a295233e-d608-4779-8b75-8c36ba7b6259",
        "indicator--451b5bd4-4d83-4093-87a2-fe1b22a3991e",
        "indicator--53fab06f-196a-478c-a23a-9bb9275df93f",
        "indicator--b9fbf61f-0cac-406d-aba1-de0649241bda",
        "indicator--b2e61067-bf24-47ef-a48f-cbca8fe5f361",
        "indicator--08362e3d-168f-435b-806c-07a1847b3c4d",
        "indicator--5954971e-2ce3-408b-8b10-7d39b40c68ae",
        "indicator--f14d17d4-ce54-4fcc-9b43-55a52c48a84f",
        "indicator--e06ff331-9945-4a0a-8c84-e7a84eb2380f",
        "indicator--c87cf65b-1c52-4230-b20d-d06a97d65a57",
        "indicator--f68032f5-cf86-4778-869f-3c13bf1e5b40",
        "indicator--e762ec6f-f19e-43e6-a41e-7e82c69d630e",
        "indicator--76fca4ce-079a-4a61-ab39-76c7d58a7807",
        "indicator--74d4d780-60e9-4989-9ef2-2a11f5895e1c",
        "indicator--8b397e9f-aba2-4724-b04c-53e4806012ca",
        "indicator--d7a99a7a-fb60-4a4b-b995-db3fd4d701ed",
        "indicator--d2979dd0-547e-4df8-ab17-998316eb3aaf",
        "indicator--8b9da76b-9f7d-4dbb-b6b2-333075f3b9f8",
        "indicator--78a39a2d-903d-4db7-b557-aa56d2e3d254",
        "indicator--2ff7d92b-c65d-457e-b21e-c89299c021fa",
        "indicator--ea66e7cc-67fc-459f-8806-52c604ac3c89",
        "indicator--17b3a142-1417-4a84-a01f-34000490557b",
        "indicator--36fc2d70-6630-48f6-8214-46e5ed78bee9",
        "indicator--0ecd6554-6950-4fae-903d-aa6248913da0",
        "indicator--a529638d-dc27-4dbd-9ffa-a75c80fdf0a2",
        "indicator--6e1ed457-a89a-4a4b-bcdb-9b24b98665da",
        "indicator--22a8d227-98b8-430c-8ef9-f94ea76680e3",
        "indicator--e35636b7-708c-4f50-af5d-354143e48149",
        "indicator--35a4de61-95fe-4ced-8551-f48e3b0c5ed3",
        "indicator--5309392f-8124-4c20-9eed-0fb5b604bf2b",
        "indicator--8974c6fa-b6ed-4edd-8290-aa77dd7d510e",
        "indicator--df904429-84cc-4bb6-b6c0-12eea39ed639",
        "indicator--ad1e9d04-f4c3-4847-a781-7327fc2fb000",
        "indicator--3026db3e-2418-4582-a725-21b44e52df89",
        "indicator--b9bcf047-f68b-47ad-a2a9-37ce3905f746",
        "indicator--fa862367-d037-4d69-a1ab-a336e6492253",
        "indicator--ce6ce735-435b-4cb0-b9e2-13bf2f306a47",
        "indicator--23b956c6-57c9-4854-8306-cc0b1ee1ea49",
        "indicator--010f7ab2-100c-4b12-a49c-b2f0ccacbca3",
        "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
        "indicator--28dbf1cc-0ae4-412c-b61e-918f9a658c1f",
        "indicator--0558e726-79e3-43b2-8173-fd50152aaef3",
        "indicator--56634424-cd22-4931-821e-da0de5f0db65",
        "indicator--89d2a7da-db1d-4231-b2cd-a56ebcb97a26",
        "indicator--ddf08ac7-e370-4115-8dad-49b9277b081d",
        "indicator--ede42e8f-b32f-4047-853c-945512a8bd0a",
        "indicator--a2ac2aae-cc6c-4418-8cb1-5922990502bd",
        "indicator--5e364cbc-2ed4-46b6-ac43-3e2c87952507",
        "indicator--64ca0923-6fb7-4ff6-85f2-3ffab8f2617f",
        "indicator--4007b76c-590a-4777-9c3b-d9012b55e451",
        "indicator--b517ff16-6dbe-4efc-bd19-49863d174f62",
        "indicator--f294e1e3-4a72-433d-8ef8-c915f1fd2f9d",
        "indicator--39f7e346-6b8e-4bb3-bc91-270fbdafb605",
        "indicator--ca5d21fd-b34d-4d55-87b2-d177f1c2ef45",
        "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
        "indicator--fd704152-96ba-47d5-87bd-7237ef3a10d0",
        "indicator--95677964-6c5f-4fbe-9985-a6bbb7ad35ee",
        "indicator--48badde7-7e31-4d0c-b047-f2516fd432bc",
        "indicator--d5d1eb3e-1a71-4155-8541-dab2c1ca8350",
        "indicator--732df7ec-9186-452f-8796-ff3adc7d5ab4",
        "indicator--b2794170-19b3-411f-baa4-e076381d757d",
        "indicator--d5fdbe0d-c6f2-46cc-b513-9c9e23025f9c",
        "indicator--6015e7fa-2702-4189-bbed-0b61dace5de1",
        "indicator--3261540a-f8ed-420e-8750-d3cc669ccb8d",
        "indicator--ab164e4c-0160-4159-b2c6-eb06fff43ba2",
        "indicator--410b2ad4-d029-4e87-8d4f-614cc4cf8f02",
        "indicator--4ded4870-b890-4d6a-9e67-e29540e2fdbd",
        "indicator--d728544f-64d8-4216-9b70-8007aa233bc5",
        "indicator--e09c2cce-f8e8-4eb1-ae15-9b75600a4a0b",
        "indicator--0678ef6e-110e-4b95-b2ad-319f3012c2dd",
        "indicator--a3965bef-e5c6-4203-b86b-1e5a58e4dcc7",
        "indicator--7c1aed59-cb99-44d8-b4db-eb52b7ea79ce",
        "indicator--e28225b2-baa4-481f-a59e-3c594ab7f92b",
        "indicator--6623e55f-a666-4c21-83d7-4889cd7438fa",
        "indicator--9b987496-72ea-473e-a2d9-6d64b6c386c3",
        "indicator--1b97194c-6f8f-45d0-9a49-577d28d8857e",
        "indicator--87c18fc3-668c-44fd-bd74-79445ac2a88e",
        "indicator--a288c3ff-488d-486a-8d5c-70eceaff4a50",
        "indicator--8d014bd1-95f3-46f3-a9ea-807eb7a5b164",
        "indicator--bd5bd2c5-6958-4ace-a128-8da52ce4eb06",
        "indicator--3b9a892f-3739-407b-8912-f0b9aa9508cc",
        "indicator--1411dc02-5772-4300-b42e-2565dc345d0d",
        "indicator--4bddc23e-9ac1-4655-bbaa-73b4c9a6ed1e",
        "indicator--4f9d539e-3404-43fc-91a6-3331d7db6e1d",
        "indicator--7ed60638-b67c-4ca9-8819-0cf5f40cbcea",
        "indicator--6e7afc83-ab2b-4325-a292-8216142ef390",
        "indicator--f28dc1d7-c31a-41fa-a660-e9de95dd864a",
        "indicator--19bec093-c11d-478a-af04-e306082a4fdf",
        "indicator--6dbbdaae-b36a-4f01-89ab-917bc0a65d7e",
        "indicator--1f1c97c3-c711-420b-be44-d27c5acd1528",
        "indicator--cf4e9024-b451-4706-85c1-8122d99cf2a3",
        "indicator--3ec1c69d-b2e6-4f6e-9038-43fd7e374e80",
        "indicator--60c1ea6c-7007-4a6d-bba8-46aa3ff523c8",
        "indicator--08c22af2-2999-4331-81e6-23235b6aab82",
        "indicator--87fe0c2a-c410-4262-8f26-0c0a40824bed",
        "indicator--8b4a70ae-2ced-40cd-a91a-59bee9f817ca",
        "indicator--5c99785f-beef-410b-b06b-f492eff7e9fe",
        "indicator--de65042d-9186-41cd-b23b-1a71da81d440",
        "indicator--8f6fcfcd-25ef-439a-84e1-bca2c92ecd2a",
        "indicator--47e2a0e1-1286-42ed-a2d6-6f346ef20c7e",
        "indicator--52b7e7e4-f84f-4f21-b1da-682fea800e3d",
        "indicator--a5dd2709-52ee-4aa4-bc77-9e457dccb28e",
        "indicator--4e55f5d1-38c6-4410-aacc-f2711e0ac840",
        "indicator--63a04514-16b7-48f8-b322-a3302b2d10ac",
        "indicator--ed0bfdc5-5849-4527-befe-fb0df3d56975",
        "indicator--b5871b91-1bf5-40c2-97f3-c59019ab4f68",
        "indicator--81eb3ed1-8e7c-4a53-9947-d916be43fba9",
        "indicator--b8126300-f384-49da-9ade-0f3475aeab7d",
        "indicator--7c9841ca-6626-43e3-a59f-e50a085f5f8d",
        "indicator--1120a2e3-3e3a-44bb-881b-9533f929438e",
        "indicator--707d6393-450b-4a7b-8cf1-f03f0d015258",
        "indicator--131b6074-fac1-40e7-b938-7647fccb2fda",
        "indicator--ccb7c101-3b06-4a57-bfaa-1179bbeef28a",
        "indicator--4c17b6d0-7842-4798-8bdd-2f08442f86de",
        "indicator--adefce6d-e9fb-433e-9840-d9702f3c56f7",
        "indicator--71445c6c-730f-414c-875f-20e5e4cd3044",
        "indicator--efe138cc-0c64-4af7-8fbd-d9fdebeb1561",
        "indicator--6da56c0c-3156-4b62-9f18-a5c066f74f67",
        "indicator--c8ab22b4-2190-46fc-9ac9-555d5e9893b8",
        "indicator--e596809e-cffb-423a-8ccc-84b8a8674f88",
        "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
        "indicator--fea7e2e9-e5ca-4963-8576-40ece88d8394",
        "indicator--2c535bd7-e9f1-438e-b515-4b69a40b0399",
        "indicator--d1f896b9-7420-4f49-9734-3dac84cee3c7",
        "indicator--294f63d7-1e01-4487-936e-39e667cbdf78",
        "indicator--eb22821b-3c61-4380-ac88-60144b32fed6",
        "indicator--e1ed780c-7051-46eb-ab05-398ed9585e78",
        "indicator--3d9adf8d-3aff-4abb-87b8-52ec007c60ce",
        "indicator--d136f6fd-3087-4c35-9cf5-98ef3a5c2f47",
        "indicator--c16eef40-437a-47f6-90fe-380264d8b5bf",
        "indicator--bf895e48-07bb-4fc5-9c36-7b16c53b9abe",
        "indicator--e95ce016-3de7-4dd0-abeb-e810a0b27381",
        "indicator--d8ef06e1-fedd-40a5-b50b-b123d4433d6c",
        "indicator--d0ce0278-cd04-4ba7-a645-ca668013b0cd",
        "indicator--76b088cc-c8bb-44c6-9668-e6b2f14ee5e0",
        "indicator--b3bda5f0-9df9-4aab-bf18-7a4650972d1f",
        "indicator--00abe1fb-a476-451d-9c8c-d6c691d41e10",
        "indicator--230fa4f7-e9ec-4787-b920-89a16fbb30ef",
        "indicator--47e04933-e953-44ef-9af0-ac91d65e3fe4",
        "indicator--3927e64d-32e5-46e4-8183-58915b480219",
        "indicator--89e75385-fac7-4ace-bfbd-7a0b5db617e6",
        "indicator--52f97db8-8506-4fd0-a0bc-dc1a914f035e",
        "indicator--6addbb3c-f736-4d79-bb76-9d92d356c993",
        "indicator--ad5c3ac4-97a2-4593-b133-832a4f2405a5",
        "indicator--0c2ef40c-31f5-4767-9a28-06aa527ca533",
        "indicator--105159cf-0dd6-4a70-bf46-2813d8cba473",
        "indicator--6aee649e-606e-45e0-8cc5-af5d2317beb2",
        "indicator--5f9dd401-c5fa-4831-ba18-c84bf05a426f",
        "indicator--2bc0ed04-fb02-4c16-b474-c3a883dc0451",
        "indicator--49105731-cfef-4103-b30f-8c2a084c9533",
        "indicator--3eba2816-feab-4a01-ab19-ce3684bf77ea",
        "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
        "indicator--a411ecd6-135b-4ac0-9354-e2b3e752df2d",
        "indicator--ac9bdc90-e53b-4972-b337-11c2dbc18da7",
        "indicator--13c4c5fb-34e0-4fe4-9552-2dc380fffde7",
        "indicator--9ed9acf3-87c9-443d-a875-63d801953d97",
        "indicator--374fef9c-9004-4a6c-ba14-649b1a9a98a3",
        "indicator--1e7c25dc-3eb6-4a8d-bdb2-0d1500b1fda0",
        "indicator--6a2f5078-26ae-4bd5-93f2-8ce8f89180b5",
        "indicator--f5423a27-15e3-4ace-a62e-0b5681f2b360",
        "indicator--a4cd10d7-39e8-4393-a997-15bd3d1d2bf5",
        "indicator--3b0c7254-98d5-4a9e-8f54-0f4d3f96c6ff",
        "indicator--8af1def3-9811-4242-8a9f-9112c7e43593",
        "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
        "indicator--4ef9d0e0-97bc-4bc4-b38e-c96f0be24d2a",
        "indicator--ab72717a-7d4e-4058-8adc-a8e0a07ba07f",
        "indicator--584f033b-0f84-4b1d-b9be-a87c6edbb86b",
        "indicator--528b248c-d232-416e-a29e-1dea243f8fa7",
        "indicator--0e6ca603-9b62-4714-8773-557a237910be",
        "indicator--f0748849-658e-4bf7-bc48-408dc19ab6da",
        "indicator--b3845628-03e8-44a0-b814-05a5ee81d7de",
        "indicator--cbd93c93-ab83-410e-b2db-c26e3b8f7c6c",
        "indicator--19f5ec92-6a48-46f0-8bc9-9f45eb82ab78",
        "indicator--b04371e7-f889-4fbc-bba8-2a4f321a2155",
        "indicator--bcb10b3c-e8de-405f-861a-cb04371697ce",
        "indicator--71590208-2c1b-4f6f-ade9-1630ba539475",
        "indicator--1f63a6a0-c9e1-4e5a-a27e-3423bcccfd12",
        "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
        "indicator--de30f9fa-9ae3-4f60-923b-3bb299702b50",
        "indicator--991a62ef-55bf-4669-9c44-1727ce641f1f",
        "indicator--49b6554b-71f3-4088-bf28-220768122e47",
        "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
        "indicator--011564ca-3757-47ff-87a9-4f84ab05bf21",
        "indicator--56535e4d-2332-4986-8ed8-60b17ae811c9",
        "indicator--1dfc83a9-5c66-4972-a45f-9a79dd0cb2aa",
        "indicator--a15af852-5deb-408f-9f9d-acc17ab753c1",
        "indicator--ab0d827a-d24e-473f-aed2-5bc894a072a8",
        "indicator--8a75f197-86e1-4b79-9945-3520e988d6a9",
        "indicator--595c0b7a-1c2a-4909-888c-f72c2d4674e7",
        "indicator--7f9cb8a4-f910-457e-92da-7092f8b73b74",
        "indicator--055402f4-2307-44bf-8308-b466c077e331",
        "indicator--dfb04da1-9b7f-496b-9522-7c8aff2a80f4",
        "indicator--4bbd940a-9564-41bf-8ece-2340057c6bd9",
        "indicator--c48f338c-064a-437a-a3db-d781f25f3a07",
        "indicator--95158ebb-87bc-4501-8ec2-b5274d624a5c",
        "indicator--933493f9-8ac6-4f79-886e-f241f5d2012e",
        "indicator--fde35f30-1f7e-4c1a-bb8f-9ae98fb599b7",
        "indicator--ee6bc55f-d597-4279-8c02-a11120fbb18d",
        "indicator--65731fa6-979a-40ab-b108-040dc7c90eeb",
        "indicator--ac0e57d6-de9b-4dfc-9a56-cd403111afa8",
        "indicator--5831ca75-4c64-407a-9c66-02b431b574b0",
        "indicator--c8d9e4e3-b7a8-4d1c-a486-8bb7e83d2ce7",
        "indicator--1664d349-d511-45c9-bc9d-fa08bda3816e",
        "indicator--351c6750-cbe2-4830-83df-41c9531cc870",
        "indicator--6b2abfbe-41c6-4c02-a8a4-0df8f8f03d89",
        "indicator--6200749c-d444-4af0-bd16-976f68b114e7",
        "indicator--15a904cc-c200-457d-81ff-7c18aee8132f",
        "indicator--9e8672b8-a76d-42b5-a7c4-a6ca15ac3718",
        "indicator--a90c024e-a4d4-40ee-9502-389958ed3928",
        "indicator--50320f92-a4f8-4e53-ac9e-bb01a7bb844b",
        "indicator--c36d6132-0353-4a56-9473-7cf645b750e4",
        "indicator--81c3cbe4-c7d4-4df8-aaa4-0310a213e390",
        "indicator--1da3aca2-23a6-464a-9941-838285c0a977",
        "indicator--8a68e861-1df2-4a5a-b1fb-267d3a85a463",
        "indicator--7bec56cd-b638-4e71-badc-ba0f5a80795c",
        "indicator--fe1c2b21-ca88-4225-af67-954bedf2d52f",
        "indicator--a35fd072-29ba-46cf-90c6-37bf7f8b1274",
        "indicator--198aa355-156d-4696-a1c7-b47f2888fc75",
        "indicator--f73e9241-ca01-4e50-b1fc-12404729e83f",
        "indicator--18858dba-4f42-4ebe-82a3-cd9e37c31c71",
        "indicator--3829a947-59f0-401b-a37a-1be6ca8022e3",
        "indicator--fd33d352-6a2c-4a99-984a-92894252e9eb",
        "indicator--5700a6f6-9b16-47d8-9724-4325863584a0",
        "indicator--a5ac7084-07e1-4064-851e-3469cb765ce4",
        "indicator--e0775727-f3e8-4df0-b338-4776a8724ad5",
        "indicator--88dc5f3c-3f63-4ed8-8517-546d89bc761e",
        "indicator--3e6e654a-e4ee-4a79-adad-5d114634b4e1",
        "indicator--be5fc062-295c-4bd1-93ee-4d0b91a90c50",
        "indicator--5eac3954-e06e-40de-9a42-380cf8b81e5a",
        "indicator--3a873c81-9a1e-47c2-8b51-1b0cc9548a78",
        "indicator--2d2ada0c-5e5c-4319-9e65-e8a71233d0fa",
        "indicator--4186765f-e51b-44a0-a228-2c62a41c1e86",
        "indicator--c82411a1-48f6-41d7-b309-215ebe65f12e",
        "indicator--40fde6e0-7217-43d7-b23d-afda5ec03972",
        "indicator--a39cdb7b-32f9-4ea6-b02f-a9037ecd3e52",
        "indicator--59f176b7-3775-4083-a141-13559a5c33d1",
        "indicator--5e552172-1ef7-4a26-bd20-f37cd72931da",
        "indicator--baccd5e0-89ed-41f4-976b-c7ac71e0d4f9",
        "indicator--2ddcb891-07cc-4651-8e71-ca64dbe78143",
        "indicator--dd2df1a0-79f7-4a0a-af06-bd9b096e9d25",
        "indicator--353ac397-f08c-4077-93d9-a47cfb1079de",
        "indicator--6f624473-f654-4434-a91a-7b3b824f36eb",
        "indicator--35a4d20c-088d-4be1-8f89-ae6037bb8873",
        "indicator--9d838f7e-78e1-4917-8ed0-cd62323a9f91",
        "indicator--828315a3-dbe1-4e65-87c0-6f692a549b5c",
        "indicator--9b189d53-10c7-424e-9a81-bf898cd4e143",
        "indicator--fb399620-8f92-40f0-9322-a649cc730803",
        "indicator--41565801-7ac5-4e56-addf-fc0387b8425a",
        "indicator--4881cddf-9851-4a1f-89d1-11930c167ada",
        "indicator--bddda6e5-5992-4b92-8db5-42e914a74314",
        "indicator--df9db77d-5311-4386-9161-1a798ae62b6e",
        "indicator--1935be9e-0b14-46f2-ba38-fd50a26209e8",
        "indicator--85151ac7-d9a0-4bc3-9c85-95127bbde6a8",
        "indicator--699966b0-d8ef-4e5d-a4a4-e7e2255e4748",
        "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
        "indicator--59440d8c-81bb-4131-9cc0-667bd1610b87",
        "indicator--738e05df-d866-42c6-9968-2fad2cc2c424",
        "indicator--679bb244-84e4-460a-a081-b51d23289191",
        "indicator--c5810723-99a2-4f00-8c0c-dc606538aae7",
        "indicator--2804aa72-9039-4a23-a441-08ba0d4606c6",
        "indicator--dd5eb1cd-c338-4431-bdd1-c002142f0427",
        "indicator--246df92f-9843-4aa9-b635-743936f0977d",
        "indicator--edc88cda-2ee9-406a-b390-3b333b1aaa19",
        "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
        "indicator--3c48220a-418c-4baf-a744-f1b79c34eb4f",
        "indicator--bf9b5d5e-690e-485b-931a-99bbf30d874b",
        "indicator--99ad0b7e-a40e-437f-acd6-82eab62f4a7d",
        "indicator--4483d9b3-9fed-4858-a90b-513beb843804",
        "indicator--b8b54df9-a153-4dde-9f39-8e4b3884b183",
        "indicator--038b112f-8f6f-40ea-bb8f-8bf56e7b1366",
        "indicator--da8cfb83-ab7b-44c3-81e1-db6622ee6001",
        "indicator--cf0b80fe-1b3d-470d-9945-d0ac93b30be2",
        "indicator--24271114-7b1d-4f1a-9ca6-764b42057f69",
        "indicator--926ef88b-5158-4487-a3fa-9d6d5eabd296",
        "indicator--99e126df-0f05-4c6e-8950-6d7b4021ec56",
        "indicator--f3adb647-f78d-4a0a-b872-ebad10f2947d",
        "indicator--8d14157b-678d-49c4-b9ba-f021ea6e1f4a",
        "indicator--69e24467-3594-4e1a-b2c0-7af66d00c53f",
        "indicator--ced04aa0-9dcd-4dc7-b04b-35e47c10fbe6",
        "indicator--2b8234ee-6f03-4163-a657-7d4aa3b957ce",
        "indicator--c030da3e-5909-45a3-a3e6-d663e2653fb7",
        "indicator--83820d0b-905d-4763-9658-ffad59ea5216",
        "indicator--1c4e9ad5-b332-40f7-9b8f-e3cde118223d",
        "indicator--50098261-9ac9-4741-9e21-ef73a197db11",
        "indicator--6eed7d95-6b3b-4f38-b3ef-1fa57affcb3c",
        "indicator--f95475c2-d299-4f3a-b92b-86aaf34bbce7",
        "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
        "indicator--6a6dbe57-5f3e-4e60-8f9c-44ce94e8fb48",
        "indicator--4346eac8-a5ff-4e9b-b322-7f3ec359da2b",
        "indicator--96a1cc5a-7934-4551-82e3-a4095699cdae",
        "indicator--47a32ec8-a507-4996-bbdf-a6abf1c7dc3e",
        "indicator--d543e1c4-9c1d-4fe6-94d5-e4ffe7f82cb9",
        "indicator--b9d2eff1-bb05-4ae7-ae63-bb720bd9dcc3",
        "indicator--3be643ea-c439-4440-8c97-28760395eda0",
        "indicator--4add08bc-ea89-4fc4-8d51-7d0502051ea7",
        "indicator--540a5209-ba64-4925-b545-210d72727303",
        "indicator--11e3e12d-4dfa-4919-a7cb-64188b29b465",
        "indicator--ee512568-d396-462e-a08b-b0d24af60899",
        "indicator--6d2b3269-f70b-4658-8d2a-9f4fe35a255c",
        "indicator--11451054-969e-4d55-9150-04361c468977",
        "indicator--5ba4ec8b-f30c-49cd-bd74-2f6e8ead9120",
        "indicator--ece707e1-df3c-4035-9dad-083951faff33",
        "indicator--be430f6a-d388-49e3-b852-858e2aa7c8c4",
        "indicator--2e872248-5c0f-4af3-934b-441a529717f4",
        "indicator--1b1b1deb-f92e-49b8-9eb5-510d627b7de2",
        "indicator--3c43ed44-ac38-4142-8826-5bc8dfeba74f",
        "indicator--13f04f0d-4e10-4b39-a8f2-e40e59fbe5c9",
        "indicator--3e32050d-32f0-4d2d-acae-e40f449503b0",
        "indicator--901b1bcd-0d93-475c-88ad-3f943f2e0943",
        "indicator--df092d69-678b-48d8-ac62-3831f01a96a6",
        "indicator--50fcff65-4127-4241-8e5a-78e0e5985774",
        "indicator--008e660c-7260-4723-8365-f13b0ba5426a",
        "indicator--0a951788-4067-4851-8f95-b4750dd04c4a",
        "indicator--bd5e3156-5714-418f-8dca-11a577a6d947",
        "indicator--fdda5bbb-9495-4a44-939d-401586ea37b1",
        "indicator--14f2b716-5897-4c33-877b-8446baff27b3",
        "indicator--b73ffff4-54d5-4f83-8552-37782a908075",
        "indicator--0cf9a0b6-05cc-4ca2-b747-4ceec9802d3e",
        "indicator--7f63f0ac-792e-42a6-8bec-b1af6cf7c1fd",
        "indicator--ee244a79-28ba-4d96-a011-0af8de2bc3b4",
        "indicator--1c898345-58c9-4793-8164-364f851caa0d",
        "indicator--f4d32c38-20b3-464e-886f-91f53bf14258",
        "indicator--ea01a56c-483c-465c-a680-6e7b4b6af095",
        "indicator--65cf1d75-a3e0-4ddb-aebe-c2f6087e3afd",
        "indicator--f7334936-d8e2-4f59-82cf-9ab04519a416",
        "indicator--010207a8-a502-4dad-af58-d885b1c0cc54",
        "indicator--ac61c4aa-9356-46b0-91a6-568786ee1633",
        "indicator--1241c77d-e21b-4258-8098-81394d825055",
        "indicator--b8173d4f-66cc-4b1a-927c-dcd2adac34ff",
        "indicator--91f296e8-b62f-47bf-ac6f-1cfcb8d76b12",
        "indicator--90e5f2aa-ac27-4126-bb1d-67d72ae96b34",
        "indicator--cab205af-7b7e-43e3-a8d3-57d0b24d941d",
        "indicator--2e1dff0b-32d8-43bc-bb10-7ee06da9b545",
        "indicator--d76f9f28-86f9-4ac9-ac29-5871312412ce",
        "indicator--b5baed3a-bd3e-4ac8-a206-5ac25574fedd",
        "indicator--2cf5451e-a72a-440f-9c3b-4c51481eea7c",
        "indicator--87abdd45-092d-4b6e-bc40-2f4693223930",
        "indicator--a6ac0a74-9b2d-4dbd-8686-9938211c5a90",
        "indicator--40557a71-43db-4ad3-97e2-fa8502686c50",
        "indicator--a5ad1035-cfb5-45b2-ba8a-c02c70e75077",
        "indicator--94d55a57-53e6-4f39-b1d5-4529f8b512de",
        "indicator--1f298df0-5ba7-4948-96b2-9bdafc077f01",
        "indicator--6a276940-fa49-4e03-9d04-bf5124bce06d",
        "indicator--d8db8e69-b013-44ce-9e2d-aa70f1961b5b",
        "indicator--37ede4ff-7597-4084-90f2-4cf32f2d71c1",
        "indicator--c356afeb-4d28-4153-ae45-83d2218c4bb6",
        "indicator--da745b2b-7130-4692-a738-0e5c9fbe1cec",
        "indicator--0b81bb7d-8f38-4e87-b414-b22bb3376e1b",
        "indicator--62cede67-189b-4662-b4a7-dbf933755260",
        "indicator--2f6192c5-6955-4416-831e-898de101a3b4",
        "indicator--6f614d8e-8bb3-440a-aa60-df0c79e7e4de",
        "indicator--4a026e31-1c9f-4060-8c0d-9cffb432c1a1",
        "indicator--96199207-705d-4f19-959a-3d53c9a0a8bf",
        "indicator--649424db-3a81-4ddf-ba3f-aaa92c0f96a1",
        "indicator--317b0e6c-e366-4a1f-a7de-c048424c7b88",
        "indicator--fc3d1b17-ef5f-4e5b-9743-d9159d12e979",
        "indicator--979fc355-bb49-4d84-83f4-1652bd4a1b89",
        "indicator--5139945c-9ee1-4e9b-bd1b-fedafc5118ba",
        "indicator--0e7a4215-8cc3-4dfe-b645-1187e37f115b",
        "indicator--67557ab3-0f09-4726-a352-73c90e59ba49",
        "indicator--c32f7cee-7bbc-4c18-8c92-569ed8194428",
        "indicator--6b5f6ac4-3d9e-4aef-ab3c-9d5f56835d57",
        "indicator--758c942f-c905-4030-87af-9ccf1b41d00f",
        "indicator--06c25a7b-6934-4219-acab-d1d0a62479e4",
        "indicator--90918056-9489-4cbb-9a87-8c40cb2e19a6",
        "indicator--545aabf5-372b-4914-aa91-4230435ffbbc",
        "indicator--643c7d9c-7371-4c1f-87f9-ae2551ee3593",
        "indicator--1bb7035b-9c00-4e12-9635-4ab8529aafe8",
        "indicator--0646ebf0-63a8-4db6-a897-7caa907a1c15",
        "indicator--e7c81616-0c31-42f5-801a-2fbbf5dfa649",
        "indicator--bf23f28f-af59-445f-af94-9dadc1223a99",
        "indicator--2fc9c82e-79d3-49c8-a160-a675a99833c5",
        "indicator--ba0f8372-f616-4df9-8597-9283f3841e53",
        "indicator--de100b42-7369-48a1-8f95-5fd38c44ccf0",
        "indicator--cb07e1a1-b89c-4a9d-b1a2-fbf35e40e5a6",
        "indicator--17eeafa5-40a0-4f37-be67-f6ac67565194",
        "indicator--150964df-9428-44e5-8dff-08a38e0d8e9c",
        "indicator--4bc94017-ebcf-43a3-8f95-8f4f648474da",
        "indicator--65142742-1820-45ea-aa9b-99f32852b56f",
        "indicator--d8631204-cea7-4d7d-b630-964d4f5d315a",
        "indicator--faed3678-23bb-439d-ba70-b357c22056d0",
        "indicator--4a1092c6-6e7a-4fd9-bf50-4c625c5b04e3",
        "indicator--135ebce8-1c4e-4787-adfe-cfe562247b4e",
        "indicator--ae027052-7b83-404d-9c64-21036a92557c",
        "indicator--bc6e4a11-0ca5-437c-bbc7-d612da0ffe57",
        "indicator--11d412cb-fc88-4678-aac9-a0bc854baabc",
        "indicator--c2fcb54f-0d43-4257-8374-a346496f813e",
        "indicator--b428a7ba-639e-4b3f-83f9-4ab846f926e6",
        "indicator--152dc516-7fc5-4c06-88d7-845a4aee09d9",
        "indicator--6581586d-68fb-44ae-bde8-3dad6cbad269",
        "indicator--121ba137-350c-4571-b692-d45e62db4c86",
        "indicator--e2129849-33a3-4156-865d-bf93a7f95060",
        "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
        "indicator--2c9717a3-54ae-422c-9698-55942832a6eb",
        "indicator--8fab25a5-bca5-4b86-a78b-c491f7c1a9da",
        "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
        "indicator--63f9e387-707c-4f4e-867e-93e0b2b0cdf2",
        "indicator--d96873f3-c6a6-4c28-94c2-231b470a00f6",
        "indicator--e423ddee-1a00-4100-b04d-38cdbc30189c",
        "indicator--237e5344-7c34-4362-8335-758729c55a0b",
        "indicator--60d017ee-3f6f-49da-8946-fb92d6020da8",
        "indicator--3ac7fae6-20eb-42e4-8eed-cef292e84526",
        "indicator--42f23870-1e39-44bd-8f69-33513fd237cd",
        "indicator--eed63b19-ba2c-43b6-9356-3bf415f5c83b",
        "indicator--d243aeb4-a2ba-4030-8259-c176b023989a",
        "indicator--b2b184ae-3b7c-47af-b74f-1e23defca754",
        "indicator--b949d6b6-5001-4a9a-b97e-e148a14c9471",
        "indicator--61819121-b9cf-4688-989d-9c64530ab605",
        "indicator--321f6698-d551-4c57-9505-dc8b07271e73",
        "indicator--1996c168-4a34-430e-94f7-17383b1fa311",
        "indicator--1242eca2-be8c-42d6-821f-1d2ee988965a",
        "indicator--7593deeb-394a-4832-afc2-b2d2f6d92a6c",
        "indicator--b24df556-6e13-401d-a418-813df12f6392",
        "indicator--179b7134-2eda-409b-bab7-1f8884793112",
        "indicator--b5abe24a-0f5f-4629-b4bb-e185decb4550",
        "indicator--62ba3f1b-8218-4a82-a9f9-65ee2a97fcea",
        "indicator--0dbb1265-d253-43b1-a71b-df256c22ae48",
        "indicator--7f54530f-12c1-45e4-89a8-fd7dc2fcf146",
        "indicator--b2444b9d-8bc1-433a-8271-bf7f454665fb",
        "indicator--27aa797d-91e1-4343-b2ac-ae290b3c715b",
        "indicator--72e30063-a423-41ac-80d7-14cef35df29e",
        "indicator--59596866-caba-4832-ae80-7ca9fb429254",
        "indicator--6ee27039-63d1-4fa9-af28-69a5419627e3",
        "indicator--363ba297-fb4f-4285-8253-8cc9c965d2dc",
        "indicator--8ffa1297-efa3-4810-bf7c-a450553ead74",
        "indicator--d2bcd02c-7488-4e65-bb03-efd49097cd03",
        "indicator--1f53d2af-bf55-47e4-8062-31b43e9d22eb",
        "indicator--1e814aa5-997d-4aa4-884c-f75103d1c83b",
        "indicator--4432fb1a-ed83-46af-abd3-cb8001e862e6",
        "indicator--3eeea2b1-bd33-4fdf-af42-eab1e5712f2c",
        "indicator--17467e82-89a9-458c-90d7-14b87ed7caea",
        "indicator--33756fb2-bc9b-43de-a4b7-baa4723d2249",
        "indicator--8b8f73c4-70be-4c11-ae8f-6918e62a3833",
        "indicator--b37c5b5b-8b40-450e-8600-d36530600284",
        "indicator--40535e7d-8a1e-42a2-b0c8-6f15526fb895",
        "indicator--15294ca4-e8be-4123-8add-c99c234d942e",
        "indicator--4ed40e15-d1d9-402c-814c-f4a51ba5c26e",
        "indicator--2340e2d2-d21c-4c33-9cbb-1a1c1d93b086",
        "indicator--e01efea0-3ae8-49d3-9dbc-eb7eee46e294",
        "indicator--c5b095df-c478-4781-95e9-b13b361c7f1e",
        "indicator--4cfa0d95-35c1-4254-bbe6-73f40f911ea2",
        "indicator--8b769d3b-3133-4a2e-87a7-4d818a2ffd42",
        "indicator--1cf2894f-6bd1-4ab4-8c1c-e92449618ec3",
        "indicator--cc3eb471-9b42-46e1-bf76-153465ba6b57",
        "indicator--cdcbe21e-3aab-408b-a6bf-5105c6ea4707",
        "indicator--600a0a3d-bfd2-46e2-ac3f-caf70f723279",
        "indicator--fd49f28b-544f-4220-b741-8c92a9837f14",
        "indicator--542aae69-2ef7-42ab-8758-07eb21cea70b",
        "indicator--ec664993-85ac-4b7f-920d-31a99b4aebba",
        "indicator--045dad7c-abb4-4e62-aa28-c7578bea0638",
        "indicator--bc514496-42cb-42da-8957-55bf22104a53",
        "indicator--73511351-a704-43a5-a545-0667cf55ad69",
        "indicator--0cf98ca6-1034-4863-879f-2b2af4953529",
        "indicator--1d18c60a-6ed9-4486-9e12-0104d09e72a7",
        "indicator--1ef59579-d552-483e-82d2-baca5b1f4fc1",
        "indicator--1d02f3f6-076b-42fe-86bb-1cff4c5b832e",
        "indicator--5c508141-e30f-4838-ab94-f6726cf67076",
        "indicator--3083f9d4-da1b-4882-be28-f3bfdb8d1347",
        "indicator--dc631b20-cd1e-4f39-81bf-338db4421ae1",
        "indicator--73f5d47b-ed2f-4341-8e9b-9d75dc11f139",
        "indicator--6ef9d153-18c9-448b-8602-531498e445f6",
        "indicator--7d3f1a7a-58a9-4673-acee-04d06bed09ea",
        "indicator--35c03d8e-255b-4316-bba9-6a9fcc93f14d",
        "indicator--d577b099-401b-440f-bbc8-cdc3ce426d2f",
        "indicator--118b2e7b-4a36-41a6-b1d4-8a836371c5e6",
        "indicator--09ade1bf-df82-43d3-b173-74a973e28f89",
        "indicator--105b11da-e165-4008-968a-241ae5d3718a",
        "indicator--eb3c0e2a-8ea0-4f82-87c8-def5eddd6fcb",
        "indicator--6960e07c-4d87-4d59-8fea-c7a733a2adbb",
        "indicator--2e73308b-4711-4551-94a3-71abef6a6a20",
        "indicator--22d96690-81f8-417a-9e4a-0ebddc3214dc",
        "indicator--8cbd1adc-9a35-4f97-bc9b-ca1940ff1d4f",
        "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
        "indicator--bd16a9ab-5c0b-45ae-af5d-e78ba792b6f9",
        "indicator--0df07722-77b3-4683-9a59-e1ad7e70bfa0",
        "indicator--6e5ce91b-430b-43f0-a414-42bf794bb8fb",
        "indicator--ada5160d-a91f-4a2d-9621-1aa9fcde905b",
        "indicator--6a440cad-00e7-4050-8e57-dd7bbc76aa54",
        "indicator--31d64b42-ef29-41ec-b672-b2e7e5a48232",
        "indicator--f9bebd10-14a4-427d-b26c-ee9198497d82",
        "indicator--63df61dc-5639-43f2-9ded-55015c5d6f81",
        "indicator--be3194c0-75be-43d6-abfd-a9e038bfe51f",
        "indicator--13e677ad-6dc9-40c1-91b0-f75573421e8a",
        "indicator--5065f73d-23df-442e-af63-f300218b59e5",
        "indicator--63e4f8de-02a2-46bd-8b86-532d700e5345",
        "indicator--ba8a6912-8855-4780-b1f2-cc5f6e42a391",
        "indicator--dc4f0f43-3664-4bcb-b902-2d1f0e2fde69",
        "indicator--6c06069c-6e91-429a-b6da-e092cfe59ee2",
        "indicator--d9d86535-69c9-43a4-94df-5ce5c13de6be",
        "indicator--4d2f8d10-e01b-4539-9b88-5adfd46a758d",
        "indicator--2e82ef3a-bff6-470d-b292-444cc152725a",
        "indicator--3f9bb0f1-69af-47ee-9736-6f39161e4fcf",
        "indicator--1617166b-e86f-4197-9904-4d2a12450fc5",
        "indicator--1fdcc66e-5960-4d38-bc3c-e7b10f669299",
        "indicator--7f74ad54-e514-4f95-bd6b-95b41db61474",
        "indicator--2652c88e-78f1-48fd-b2ad-05d9163d329f",
        "indicator--cbe805f7-ea0c-4463-a228-f83167343725",
        "indicator--2fd0247b-02be-42d5-bd8a-8fd2c15f73f5",
        "indicator--0763fe42-007b-49f1-9797-6a351cfc84a9",
        "indicator--d833e2a4-e5a3-4bd3-bf70-615581fd3cea",
        "indicator--c43cc9ae-bf0b-476b-adb6-c785fac0d52b",
        "indicator--a56bbb1d-72f2-4335-a84a-b9b52a9b093b",
        "indicator--4a43ad6b-4b69-470e-b75d-e9d50feee377",
        "indicator--4b6732fc-6159-4602-a2a2-5db0c5bbe69e",
        "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
        "indicator--e0af87fd-f315-4e84-bdee-9e2f993bfb2f",
        "indicator--c84337bb-c048-4c76-a263-78d3d128b053",
        "indicator--d17bf593-57e9-4786-b2cf-f29fd7b660c5",
        "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
        "indicator--2f04636d-b3a5-4511-aaa5-6f305d587080",
        "indicator--7e981756-3b7a-467a-9cc0-75e77892a2e7",
        "indicator--208d418e-95d0-49e3-a61a-698d12364706",
        "indicator--e3aebbe5-e7ac-4b74-bc05-23d1568ab917",
        "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
        "indicator--e44c1b21-749a-4f0a-b47a-39bf168495dd",
        "indicator--57d6ac12-8332-4c60-8b20-73fa509c7685",
        "indicator--83cbacdb-4a64-4bdc-82d5-07cf7eeab0a8",
        "indicator--55827aef-e450-4380-8dbc-3d7998867719",
        "indicator--1336d06f-0ca1-4ed3-bb4c-2baa4e09635d",
        "indicator--add26371-178d-4f79-9275-617082baaa37",
        "indicator--2ad41849-097d-47d2-a96b-bd12349481ec",
        "indicator--f9811cfe-dc38-49f4-834e-fe84894b956f",
        "indicator--fc5e5c81-5d10-4755-b57a-6cdefd500fb0",
        "indicator--0543b475-388d-452f-8173-c6403e39bb3c",
        "indicator--6f99147f-bb18-43dd-b873-9b3c733871ce",
        "indicator--06599d2f-34fa-48dc-9a4b-fa1ddc9b9b41",
        "indicator--5196be21-fa53-420d-9d02-2f7501aeed07",
        "indicator--1ec71da1-c084-46d4-a946-ab8373e8179f",
        "indicator--312aba89-e6ab-4966-93f4-47b92720b10b",
        "indicator--da587325-269f-4116-8f7b-75281b560267",
        "indicator--9049874c-0ae7-44b3-a9a2-3506abbd22fc",
        "indicator--c35e1159-ffc9-4f6b-a57e-8806ff6f914e",
        "indicator--a17edf49-95dd-4ae5-b068-315b427ad8db",
        "indicator--fa4e4c8d-3e02-43e1-9347-c0990b37ab03",
        "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
        "indicator--7572820d-c87d-4fe6-9159-d929fffa8c55",
        "indicator--6530685f-1855-4454-993e-116b1459f4b4",
        "indicator--a99aeb64-3732-4961-a49d-edc6cd2a4415",
        "indicator--1bd14718-1af4-4293-a628-5ecc6f2293ab",
        "indicator--1659c9e2-9344-44cc-885e-dc39dfff5824",
        "indicator--da4c5267-27a0-412e-87fc-edf02ee9b52c",
        "indicator--594e472f-c30a-404f-a38f-329ec40c17c6",
        "indicator--17fe5ca8-9c6d-41f0-a251-ea3d9c25a982",
        "indicator--1baa88b4-47e9-4313-ae47-0e0d589328a1",
        "indicator--0167e5a7-2a98-4ae4-b863-8d1c1d8f4bc9",
        "indicator--7e7402d4-86c8-43fa-81c9-431ec020db21",
        "indicator--90b84d7b-3d15-4462-959d-10d25c77f0a9",
        "indicator--a767c2b9-0c0f-4d3e-94fd-90ebba7e55f8",
        "indicator--d4ff81e0-0d21-4899-932c-9372504705ee",
        "indicator--3f4b40a4-aa79-4e10-9bfe-16228a1bbb42",
        "indicator--4f52d406-c657-4a83-9619-a0ef6853b51e",
        "indicator--d7eec1bc-74ff-4c25-8022-cf2b5dbc0d80",
        "indicator--b5c68010-699b-4a3e-8aa5-95158ffd13b2",
        "indicator--0540166e-0220-4d28-bcbd-c4696b8d9936",
        "indicator--c5b50114-ba52-414e-b6b3-5ac6348f0bf3",
        "indicator--10042647-85ba-481b-8b15-aa26e3a33891",
        "indicator--ed427ab5-5b05-4855-9950-95e8c32fa80e",
        "indicator--863926b0-833b-460a-aabb-4dc8067ecd2b",
        "indicator--fe60707b-d69e-4ef8-8053-971fd68cb8f3",
        "indicator--b4a05d0b-813b-4960-8e75-b41687de2405",
        "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
        "indicator--eaaefae8-82b8-4a16-8a70-61b4a5e8e34d",
        "indicator--9ec9a745-ac3b-4714-8a8e-f7e0387fc063",
        "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
        "indicator--ed4b75a0-9133-4b17-9f17-5f01d529d5f5",
        "indicator--8e50dff4-0c71-4e01-ae12-c865e118aab7",
        "indicator--0d986215-eff8-4efc-9d14-6ef2277cd551",
        "indicator--1ee3bbfd-bc27-43f4-b385-ce6e208d5ea0",
        "indicator--3b571ea9-f388-4069-940c-9a418bb7bd4a",
        "indicator--7deb5de3-35d7-4da4-8fdf-226e1e58faac",
        "indicator--ee689902-5743-49c5-a7c5-07476c0ac280",
        "indicator--b0fc6c31-a137-408a-af95-d0e360ae781b",
        "indicator--11d5f4d9-d356-42a6-b9b7-357b7117a1b8",
        "indicator--cfcd06c8-f037-4506-a7ad-62c955a6c2c3",
        "indicator--ca9e956f-bb57-472d-b5d3-229f6fc78f2a",
        "indicator--825293ee-d7c6-4367-8633-92dae6f7c75a",
        "indicator--f4dd1899-99af-44de-8867-889c66141fcc",
        "indicator--c3bd6849-38f6-49a7-bca7-099edbfd57b5",
        "indicator--d34393b0-351a-4138-938a-b6de0924d055",
        "indicator--ae9a5c60-87d8-4afc-8abb-020e2583184b",
        "indicator--a2c1b226-16d3-487a-acf2-0841deef70b3",
        "indicator--eba98da1-bdec-4a7c-bb43-f4b73ab21ce2",
        "indicator--e90c61e4-0eb8-4d6c-b426-6361dd1dcc71",
        "indicator--6c32972a-0587-41e3-8409-b266a98f79fe",
        "indicator--9d76fcab-3e37-4ab6-8061-38099b542c7b",
        "indicator--272a9cbb-c031-45ff-8c6e-a35d46c41c63",
        "indicator--f283abd6-d1ee-4c3d-a462-115a614f69a4",
        "indicator--c9895777-8947-46d3-82fc-7ab2a7340345",
        "indicator--cb2fd99c-1a87-4885-8ad4-d28962f485eb",
        "indicator--69d1bc23-9437-45bc-bc3f-f40574f735e1",
        "indicator--c66c39ed-4d95-4433-abd6-7380beae8743",
        "indicator--e49e3261-669b-47f7-9105-79a1af0c45f9",
        "indicator--04a2af52-5952-4c43-ac5b-28be72de0564",
        "indicator--b781d1fd-cfd1-4e65-b970-4a7954199626",
        "indicator--b9696fc4-c07e-4e5f-b360-500c8ea1a331",
        "indicator--5883033e-d60c-46d5-9cdb-2b68e3169d0a",
        "indicator--8e836d81-9f23-436f-9967-a734409c71b1",
        "indicator--fae9e4f6-0111-4124-8cb8-b8acf705cf93",
        "indicator--2ed54da8-333d-4e8b-9c6f-e37387b1685f",
        "indicator--bed0dbff-1ad2-47b0-956b-a9e169ca6e2b",
        "indicator--a81536f3-f4d2-44fa-b0d3-b26916c10162",
        "indicator--c770c341-09a7-4017-9a9b-9444e40c971d",
        "indicator--782f6e1d-6472-48d2-8c02-6f0d8eb35ed3",
        "indicator--e6d261ce-995e-471f-834c-d6770f73822d",
        "indicator--9c9fd80c-2193-4ebf-bd19-37726961653b",
        "indicator--8ac2642c-ed00-408c-9fd8-e4b55db4e8e3",
        "indicator--f4d33a00-8374-4fcf-8c4c-325893638ee0",
        "indicator--4dcb41df-372a-4da2-bbb2-b2e5de35ab20",
        "indicator--fde3b67d-3e3b-4e6c-83b8-2f6e94467b79",
        "indicator--8898f308-0e42-4014-b23e-8232e7500c16",
        "indicator--f329ad28-4ac6-4e42-8b63-22e493ec8f67",
        "indicator--8e4feadd-5746-450e-8196-2805270da414",
        "indicator--601be7e1-bf50-4f0d-92d8-d1fa2cab8d2d",
        "indicator--c82c5654-6a28-426b-a9cf-5c24e5b02a5b",
        "indicator--254cd2b8-6af8-4ef1-8e3e-561e26f4f9f0",
        "indicator--99ce82bd-c73f-4e9a-9e42-191c16539d8c",
        "indicator--d2abd04c-543c-4ed5-b83d-adc1609d36db",
        "indicator--bfdc22bf-036f-4c09-8771-593f199e3460",
        "indicator--4bf26d22-3b1f-477f-8d05-a619d481f580",
        "indicator--b240b20a-8546-45af-a47d-05bf7e8bf2be",
        "indicator--64340a7a-0884-42be-bc9f-7eed0f89a45e",
        "indicator--a3b70532-379a-4781-8166-0dcc7e5cd67b",
        "indicator--0c7b3a6f-5fdf-46ee-9398-0ccf597ea785",
        "indicator--73fac53a-1212-4af8-bcf5-95bc9b6ccefc",
        "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
        "indicator--9c73c5a3-ccaf-4367-8d60-f6ece46d8aee",
        "indicator--97c43194-6ad8-479d-b298-e53b77174b65",
        "indicator--ea94ce26-ba89-44bd-9af7-61e0af87fe02",
        "indicator--71a151c5-c5b7-4ff2-84e6-5698d005e0aa",
        "indicator--1c1f3321-9697-4fb6-a937-0efc585bb82f",
        "indicator--4ad3c694-4ada-4383-8783-81afe67d1a7b",
        "indicator--f6f65fbb-1ad3-401a-a7e9-5c59c30d3fa3",
        "indicator--a74d1041-98ed-47b7-b307-f4b2f5738f52",
        "indicator--2ec6e4ff-8783-4f02-a9ed-1d7c1cbeeae9",
        "indicator--6ff46c6b-d836-4525-b3fd-f69b47a58f8c",
        "indicator--52693bc8-252b-4fbb-bc1c-b1533c520db3",
        "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
        "indicator--588705a4-11db-4903-95f7-b239aaa6d307",
        "indicator--f4e3bdc3-220a-4f84-9d59-3ef19cde3980",
        "indicator--510d0106-f938-4379-9003-6ff1f45135af",
        "indicator--385ea253-81c3-4fd5-883f-f6bd988f055b",
        "indicator--3f6334af-c7f0-4508-bd4a-bdf5006eb634",
        "indicator--4c8aa060-577f-4be3-a677-e92db0a920ee",
        "indicator--e13dc876-bb6f-41ec-9c0e-0756db9bae8d",
        "indicator--9a4fe4cb-dc1d-41a5-aad2-ddc7623352ce",
        "indicator--b20160a4-9b16-4bda-b1c1-3fd77abad7d0",
        "indicator--d9a7748d-8f34-4c69-a927-37f91eefa3fc",
        "indicator--a665c507-8a6a-413f-b636-dd194fc5665f",
        "indicator--10afebf2-e76c-47ae-b3fe-689bc99c9c36",
        "indicator--a880e09a-e8bf-4c8e-b5a5-e1319dcad3cc",
        "indicator--5ee5aa00-22d7-431a-a0a6-2a6b3a236fa3",
        "indicator--e397d4ac-aeb7-43fe-ac11-d514eeecff1d",
        "indicator--f41a26d8-d8bf-4e92-9d9b-0c6d29a2a45a",
        "indicator--0f0a3de5-9ad6-4b02-8111-fc8c47bdb9b2",
        "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
        "indicator--3aa65c15-40c9-45db-86b3-35265bc9e921",
        "indicator--4c211673-4566-4ba3-bd53-3cffd509a6a9",
        "indicator--2561c50a-b85a-4c45-8dd9-c9f22b473d8c",
        "indicator--afb4502d-a0fd-45f5-95c3-4f161e626476",
        "indicator--6a9476ed-057e-4982-b151-95befe24d9b1",
        "indicator--0831935c-d15c-4e3f-8566-2340932be47d",
        "indicator--6622ee20-0189-47fc-a293-cb46ffad7235",
        "indicator--077f15df-635b-42d1-b703-48f601e65f7b",
        "indicator--835ae69f-a3dc-4482-b1fd-b9e2b6f6d4c6",
        "indicator--3f395b80-5e84-43d1-b58a-9c4b9295dbf8",
        "indicator--8c3ce282-57c7-4dc3-b31b-df562f585d9e",
        "indicator--abe62bc8-45fd-4986-91e6-c1ac959d6e9c",
        "indicator--66aca7fa-2830-4031-832a-c1daa226952f",
        "indicator--0805655a-ff3e-4e27-8a64-e729d80dac8a",
        "indicator--3f3ae5e2-26de-42cb-ae68-0129c994078d",
        "indicator--0947e14f-a5d4-49b3-a749-1794dfb436c7",
        "indicator--26d27fd5-11a4-430d-86ce-550068de3f66",
        "indicator--7b8a29ad-a669-4061-ac3d-8c4b822c391a",
        "indicator--d2f04745-d14f-4d84-a772-fec359fc3e9f",
        "indicator--b62d0df7-525d-4d39-abab-6745c0db0b06",
        "indicator--7d99a705-30d6-4246-a3a4-3ac2b7c303e6",
        "indicator--7032cf5d-cc5b-467c-8f03-10d79ef60dc2",
        "indicator--2a3d6c32-fdc5-49f8-acb6-49ec0471e6e3",
        "indicator--2eb842c3-f0ac-4c06-b680-cd9e08527609",
        "indicator--d28ef92b-cad0-40cc-b0f7-f29eacb61b2f",
        "indicator--ab855821-da84-4bc7-9226-7a5d4d557e45",
        "indicator--d6582bef-8ded-40c2-b71c-0cbc767face8",
        "indicator--ebb0ab2b-3e05-46a3-a5b2-3c28626c1c31",
        "indicator--87d4435b-7358-49f0-a7c4-7c9cf1d77b12",
        "indicator--17ade691-139a-49a1-8f33-0a2d51810b55",
        "indicator--7cd54d5f-aa31-40ca-b41b-7555eca4ac1d",
        "indicator--47afa391-69b0-4ab5-8a9e-edce53ccc442",
        "indicator--f6bca900-c3a9-4364-84fb-61e1e6c27b54",
        "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
        "indicator--492ebad4-fac9-4f90-af30-1bf163b13a2a",
        "indicator--615b56c7-6975-4059-9888-31277f294b78",
        "indicator--e9c98d1d-a54d-47e2-9bf3-03a5af8057d6",
        "indicator--8bc8f36f-bf1b-48f9-ac5c-403bf808ba05",
        "indicator--e035a1bf-60fb-4e15-9ecd-ce1a51ffdc6e",
        "indicator--bf587661-569b-42e9-b965-63e3ed873d92",
        "indicator--02f317d4-e515-45fb-9410-e726642f4415",
        "indicator--3f811afb-84f7-4f8b-b844-e684760d3669",
        "indicator--6bedc05e-828d-4980-8489-8506fe9df1b3",
        "indicator--0ef08495-d36e-4ea1-82ae-8df5ec8a06c5",
        "indicator--e8ca4c08-2590-467f-9a81-dcab5f564fe7",
        "indicator--b4a575ee-b702-47fc-92c7-4c1ee2f9a092",
        "indicator--7f710d24-6f2b-49ab-83f3-470b28a0ad8a",
        "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
        "indicator--4dd84991-ef34-48cf-82c4-ddaad8fc81fd",
        "indicator--f61e4fc4-f0c2-4ac8-8225-c19b255750d3",
        "indicator--2c491c39-7d51-43bc-86a7-15a8dfc1f277",
        "indicator--d29aa56e-a6b7-4ea6-aa8e-c80879eabcc1",
        "indicator--eeacc2df-9a27-432d-a995-32a09643eede",
        "indicator--09890e8f-94fc-42c2-ba15-756366864caf",
        "indicator--2b31a778-f083-4a3a-bd76-e1c5591a44fa",
        "indicator--56eb68f2-1c50-4a00-b4aa-4e545e3c42e0",
        "indicator--2ea25969-7ab8-407b-8027-11cc588b8e81",
        "indicator--f6e78952-7c29-4b2a-a343-61bee771b76b",
        "indicator--88e9e735-f546-4acd-967c-6225f4ccc7ba",
        "indicator--f715b369-b5a2-4af2-8190-739a301fb94f",
        "indicator--c95a1b2b-e47e-477c-889e-c84538f08039",
        "indicator--298c9895-4d5a-420f-9731-dcee96b62c85",
        "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
        "indicator--bb85506e-9fb1-4177-9cb3-0d50828dcd0d",
        "indicator--dbf0bd23-d0c5-4779-9f65-edec24e8849f",
        "indicator--669d04be-d62d-43da-ad07-baff49cbb8fb",
        "indicator--7ffe5435-1bab-447e-af7d-f3c48c3aad8d",
        "indicator--1d47e343-43e4-47f2-8f19-1a500de4cb91",
        "indicator--661b0504-962e-4614-bbe9-6a620c30658d",
        "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
        "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
        "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
        "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
        "indicator--6864b9ee-54e4-448b-b19f-bb3fa17dc7f4",
        "indicator--e9ed4cfe-d6c3-41e8-8d31-097469683af2",
        "indicator--d134c7a1-038f-4685-98c0-9652858b9362",
        "indicator--8ee35330-7dd2-4b65-8b82-8ff316513e30",
        "indicator--baa5b08b-1efb-4e7c-bc79-09a1e074b675",
        "indicator--ce014f29-7eb6-48d4-be30-d1b6a71422cd",
        "indicator--b6544b95-1b64-4bae-a61a-ec387938bb31",
        "indicator--2ca3f3e8-87eb-44ce-9a20-ecc0ba0d28d1",
        "indicator--8c4cb910-9a56-4f6d-a25b-0c8cfeed0f31",
        "indicator--393995cd-0951-4657-a8e4-f22cbbf7ae05",
        "indicator--4d2016fe-f2d1-4b91-9491-747f235ce864",
        "indicator--b9e04b96-4e42-4cbf-8180-be4babe5e4e1",
        "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
        "indicator--386d514b-1d8a-4a52-8cbd-ccb40c11922a",
        "indicator--a23bee22-5752-4a22-ab4d-8f5307dee533",
        "indicator--9da85368-bb82-4707-a82e-f81b9ea13d3b",
        "indicator--4ea7c29a-01c8-4758-ace6-b10a975e29d0",
        "indicator--12fd6bbf-1ea1-465c-92e7-160fc0917f9d",
        "indicator--adad80b2-225a-4976-b017-1e0b9b54f893",
        "indicator--35cd8418-0427-4df0-8e2b-dc4b445e1fb6",
        "indicator--365e732f-7cb4-46d8-8fe9-d81e24fb2ee8",
        "indicator--a04087b5-cbf4-434f-abd9-4e355dc2ef20",
        "indicator--721787ee-0d2f-4fd5-ba3a-370389cda1d0",
        "indicator--efe282a5-cdee-4b03-a22e-1cdffefc8a6e",
        "indicator--beb5deda-a9b5-4f6c-b3d8-825b3bf3d8a2",
        "indicator--7001ccbe-238f-46af-9969-3bc11ff7ea1c",
        "indicator--30261058-b764-4ca4-ab4e-09ab76c7ad6b",
        "indicator--cb21a98a-d4c6-4d19-b993-0fc446e79f90",
        "indicator--725d4513-3a98-4a02-91ac-3f365512135c",
        "indicator--a2806bbc-0710-4532-9f3a-75857e76f407",
        "indicator--9abf5f97-7a7b-42ba-8378-8dd2032eddc0",
        "indicator--544c9bb9-8e23-409b-92a2-9caf957a25c0",
        "indicator--220f2897-c1b4-4e7e-9105-6d65cd883dee",
        "indicator--eea814bd-41a1-4755-83ae-afa4bd73b3d8",
        "indicator--a99958e2-178a-4ad4-8c29-78727dc4b627",
        "indicator--4431963c-0444-4f12-ad74-15c8bf3726dd",
        "indicator--e58c22c1-fad2-45e3-9cb4-3122d43413be",
        "indicator--272ce99d-a00c-4efb-b9ff-8e4dfa3aee3f",
        "indicator--1c8ea620-7542-4a75-8904-40d9ec333087",
        "indicator--15404d08-70e6-4cad-a9b4-bb80eb42d9f3",
        "indicator--3403aac4-c857-4417-8c8d-f8f0f4dbd598",
        "indicator--99c62a6d-56b1-432a-9625-f513db14d74d",
        "indicator--67eaafe4-9327-4bab-a6d1-bac484ded4fb",
        "indicator--5a83ed0f-30b0-4362-aa84-3fae6f46b503",
        "indicator--d5772af8-bae1-4f82-9ccd-0e5476d49734",
        "indicator--3bda8182-fac4-475c-8925-6fdb02158569",
        "indicator--549fd3cd-4567-4f4f-8893-1cea8384fa30",
        "indicator--4e7f7362-ae51-4435-bb98-2ee7590ab99f",
        "indicator--23831790-8833-434c-bc02-a4a718d8c31d",
        "indicator--86bc7fca-8944-4e25-9e33-21ad4d233358",
        "indicator--300bb3de-f582-4536-856b-97638d843028",
        "indicator--ba0267be-675f-48d1-8e13-1588095e2c48",
        "indicator--a12ef09b-7267-42e0-a3fe-be3279ad735d",
        "indicator--479d7705-b1b7-45b7-ab1f-d1e3d22d617b",
        "indicator--3ff53e36-0606-4f96-97d4-5d5d880b0eeb",
        "indicator--97adae0c-7777-4773-a4bd-5a3dc4afb282",
        "indicator--c99b2d64-452a-494e-be2b-462a6b50bd75",
        "indicator--2159c48d-fdd6-44c6-8ac2-b253d1f598cc",
        "indicator--9b728d79-71b0-42e4-97fe-cca873ae6a8e",
        "indicator--dbd65ebf-c004-4c0e-98b5-9828c0bac05e",
        "indicator--de7b7d87-5f9a-4498-8e0e-2a7546340fc0",
        "indicator--bbad844f-bc56-4af8-838b-630ec987687b",
        "indicator--f17f4bf1-939f-498f-ab6a-d12276d09819",
        "indicator--34415e7b-3b08-4934-a9e6-b4354b7aea53",
        "indicator--f0bac49d-42d8-46bc-9de0-852c4ad363a8",
        "indicator--47a400b6-85af-4ee2-bf4a-582b39d460c5",
        "indicator--fc638150-91a3-4b05-8253-097c4211683e",
        "indicator--b3c8412e-bc1f-429a-bd7b-9bbc3c39c8e8",
        "indicator--9f06cbd1-95ab-44e8-b080-0ac840aa297a",
        "indicator--90326f84-4878-413b-b808-7a87172a37fb",
        "indicator--80bf01a3-cfb0-4fb7-bfcc-ba12b5a97880",
        "indicator--799737c3-498f-4502-addd-5ede02945604",
        "indicator--2e27ee0d-05a6-4c74-bd72-e4b4f594c2b4",
        "indicator--9331fa22-6ec5-423e-95c3-be911bf4068f",
        "indicator--5ca91305-f6ad-4ce5-b2ba-06f067cf9fcc",
        "indicator--2eb87225-785c-4576-b5f3-a0d6606a89ef",
        "indicator--76fb6e5d-6db7-49fc-a0a0-142a012452f3",
        "indicator--6a1ccf8f-10e1-42d9-b56f-01643b3378a5",
        "indicator--f176011c-3e5c-405c-9195-58aa92057f1a",
        "indicator--061ef1c7-bc81-4151-b0ec-cb6b6bee44bb",
        "indicator--94b8650e-8524-44d7-a24b-8e2f80ffbe26",
        "indicator--170ab6c9-8190-490d-914c-8d64f5dce090",
        "indicator--c16df00c-1e97-4415-95b4-4e6291beaaa8",
        "indicator--6ad40890-a989-4ade-8a03-00842d3739fc",
        "indicator--9169ab31-46fe-49e5-8b9b-99e66a758327",
        "indicator--188167e7-c0ce-4784-b3fe-442e47bed7a8",
        "indicator--3e8632bc-f1ec-4683-b22f-f9a0f5916f2c",
        "indicator--e44e0825-27e9-4213-9383-4a15b9ab32eb",
        "indicator--b5887385-1639-4f07-9501-ffd4fd796652",
        "indicator--48e19d7c-7ab6-459d-8205-1ef11844070d",
        "indicator--2d43185f-e2df-406a-bbd1-a61379548e64",
        "indicator--5445ce49-e724-40a6-8fc5-ab5931e1ce60",
        "indicator--1da68c9d-1e4e-41a4-9c22-a8d44a30da61",
        "indicator--e26fbf07-2083-4a21-8416-cace393d4e13",
        "indicator--6a27be23-128a-43b8-8087-c28161895b91",
        "indicator--b7b0a58d-dc76-4410-8bc2-7f1afc555a60",
        "indicator--61109bab-db34-46ef-a41a-ded8dc6c8491",
        "indicator--f364dbbc-4fa9-4153-86fe-cb7c49032ac0",
        "indicator--ceee4d46-1871-4bc1-a061-a154d316b85c",
        "indicator--52740597-e179-4ba7-9e11-c09753561031",
        "indicator--05dcecb4-27eb-43f4-b12d-89d5c09cff25",
        "indicator--76f47aca-f8d2-4dbb-9d43-af2b9e54dd1c",
        "indicator--ea10812a-005d-4f32-ad36-347cf0902095",
        "indicator--ef48fd5e-4b63-4b4c-ab64-a360c801f494",
        "indicator--bb133bcd-bb26-4e99-bae0-291a2bb2f681",
        "indicator--7c202841-b00e-49c4-9acd-bc35a30b55a9",
        "indicator--87a7f4ac-63a3-4b9b-9a92-5b878b3b8c55",
        "indicator--76dec1c2-2e95-4b7e-ae79-a6a218c7fcae",
        "indicator--dadc38d1-d807-426b-8260-9c617c9fc381",
        "indicator--6579779c-8132-4602-b8b8-ba7e038fa880",
        "indicator--e5a320f1-b2cf-4b97-b7b8-9422bb2c6d2a",
        "indicator--8c48655a-10ef-46eb-bf63-5cca3822c339",
        "indicator--73729bec-1df6-46c5-aa3a-5f2e526b1da9",
        "indicator--12b1a1ef-9e4e-4140-942f-406b6087499e",
        "indicator--26586d55-53ca-4372-b33f-386cde5d418d",
        "indicator--921cad6e-2a30-454e-b57a-b440efae6d93",
        "indicator--1a95037b-10ba-4559-98db-5b9228563e6d",
        "indicator--1a4f22eb-3449-4644-aa01-6e136e3e14bc",
        "indicator--fccc9f42-04e2-4e60-9a22-5b9d9cd3e73c",
        "indicator--1aad4a81-350f-4ac7-9b96-a8f3053f9cf5",
        "indicator--09d6cadb-5fa1-4967-b498-1c90a3eb5ed2",
        "indicator--22443efd-7d9a-45ff-829d-7d989582179b",
        "indicator--a47744e8-12ad-4621-a6cd-277154c7a012",
        "indicator--820cc459-4798-4d82-8ddb-595ec0cc44da",
        "indicator--89255984-9d79-491a-96ee-b9df5efc25ad",
        "indicator--196797eb-f946-45cd-83fe-eebc98dfb6af",
        "indicator--77847f4c-cef7-41e9-a142-6c9caa1c60a5",
        "indicator--f4030ddb-618d-4259-9f0b-2e8e965e1049",
        "indicator--e9df8461-52ba-4965-be59-9a8217b01342",
        "indicator--4883c6e5-e94d-4f37-9fc0-9458e6ef878a",
        "indicator--6aae398d-755a-4836-b70b-1bfd792712aa",
        "indicator--dbafae72-3b5f-4bea-af57-0ef05ae87bb1",
        "indicator--ddc9a389-2de2-42b7-a44c-f98ed27f9bce",
        "indicator--6030dd0e-b1f4-4972-a141-bbc10d3a5f58",
        "indicator--6db60f5b-fb81-4580-b442-933ea2ca13cf",
        "indicator--2a62427e-bf35-435a-9722-51d07f6db760",
        "indicator--806f73bf-edee-4956-b647-b8e5f7233909",
        "indicator--2bbbf436-9e81-4962-9ae4-96a04293571e",
        "indicator--ac9dd43f-2ffa-4a38-b253-e54c8fc02f59",
        "indicator--08b21604-08f5-4626-9971-90de963bb8c0",
        "indicator--e1ec8c5f-9005-4795-99ce-288d5de1fe1d",
        "indicator--eacd8e4c-d42f-4874-909b-5db4a588a20f",
        "indicator--63af8edb-d359-4cc6-88da-0c7d54137bc1",
        "indicator--8e60cd33-9f53-40f1-ac85-b18095c76fad",
        "indicator--72374af7-af77-4ff1-9302-4041df1ba5c8",
        "indicator--fd97000c-73d4-4f94-ac39-cd9fcc5c2bc4",
        "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
        "indicator--4ca9b403-4f66-481f-8a8b-857f6c53ebaa",
        "indicator--e0526d5b-7402-436b-b8ee-25ad8485f318",
        "indicator--5b10eeef-ca17-49cd-be39-2598a1f97fbc",
        "indicator--3245f218-705a-472a-8acb-b74f35e0f9c4",
        "indicator--5d7d5e3d-032f-4227-9383-bba7a8308a44",
        "indicator--a00ce505-5f52-4b3f-adee-37c4364ba5b8",
        "indicator--ce1fc6d2-88e3-4589-9c2f-ca16018dae9e",
        "indicator--5e3b0182-ec9e-4037-b70a-e98d012a3e06",
        "indicator--b8de0a91-3a7e-4dfe-b646-769de1aeb66b",
        "indicator--2360db1a-be83-40a2-b332-e01c42260786",
        "indicator--8d9d3321-c5c1-47a8-97b6-97be124cbea4",
        "indicator--cd7841ff-443d-4ac6-a6c4-c4a1f172c230",
        "indicator--040e6a2d-3d24-4223-bc07-980802a209ef",
        "indicator--c7b4e5f8-4ac6-425d-8b44-4440333b7675",
        "indicator--81d5fa00-4f1a-4173-9eee-b9787eef77d2",
        "indicator--300d8dc5-0f31-4af4-bb3e-dd453327886f",
        "indicator--aab9c233-7620-4d40-8d41-4ed91de54a7d",
        "indicator--1d70dfcf-15e5-4eca-a07e-7037fd59da3a",
        "indicator--f596e140-27ee-47b2-a855-633718690a65",
        "indicator--3174eafb-1ab1-4cf6-9d5e-92d136957375",
        "indicator--1e943582-d522-4d93-9b27-7c49963d8e15",
        "indicator--edf71903-3530-4c41-9a50-a2de753d60ea",
        "indicator--d81c3807-7bd4-4aca-9882-8e930334339a",
        "indicator--9e8f0084-2493-451d-b809-ccaa78ce5d50",
        "indicator--73a2a6a1-4fcd-4d77-bdfc-5f79f8bbeb86",
        "indicator--bf38fdc8-ca15-40cc-9cf4-36735dce4cad",
        "indicator--b13bab08-d085-4fc6-944c-0a8640e454cf",
        "indicator--d56fca11-2b26-4cba-9174-400c92415278",
        "indicator--d5622184-0961-4336-b615-e93be6684d80",
        "indicator--8c0d6964-36de-4f8a-b902-24744ceef214",
        "indicator--78738ae7-75e2-4717-915f-e46aede60694",
        "indicator--c5a3e776-4560-42d0-831d-d763b0f6ea94",
        "indicator--70ef5fc0-421c-4684-8eec-2ab18ad90785",
        "indicator--0f306129-5737-4691-8f43-e1a76390c024",
        "indicator--58787ca8-e734-4bf6-b533-5b2aaa06b62f",
        "indicator--f8296f25-ca91-4003-8ed6-12b3f3b1444b",
        "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
        "indicator--47034d4f-94de-4414-93f7-9f8de54c47f9",
        "indicator--18ba644f-a79f-429d-b9c5-ab4337551421",
        "indicator--8012b978-c08d-4c9c-bf86-97017a078085",
        "indicator--dba8ddd9-2a58-4bf2-9981-d83597d80d79",
        "indicator--f34b6ca7-0012-4522-9e10-a27d6fba3510",
        "indicator--279ac3bc-3d19-46f3-9a97-0bc2db9c937f",
        "indicator--15cba6a2-d65e-4666-8ac7-c63308f2bf72",
        "indicator--6f464778-0901-40f9-a286-932c92bcfb6f",
        "indicator--0fa1889e-52db-44d0-87fe-90e53883b050",
        "indicator--3b848875-f37a-4223-b175-1fd6a59fbb39",
        "indicator--66c2b666-febb-45c9-9070-0d6ef925b210",
        "indicator--e7bda2a7-cef8-45e2-9bb0-d639f46cd142",
        "indicator--346c1fcb-2d6d-4c4d-a5fd-94cea28cb357",
        "indicator--b6827298-50ba-4643-b521-2f7b03db514c",
        "indicator--b611c30a-872b-45b7-a532-a8363f20cf52",
        "indicator--5b698d49-cb21-45d6-9d60-f7259895c9b1",
        "indicator--81398d91-9d37-40c6-910d-c38413ee49bf",
        "indicator--bc15da62-630a-435e-8a52-97c08210d0cb",
        "indicator--a50913fb-b8cd-4a79-8038-fd22a95c2008",
        "indicator--b2af1739-b9ea-4913-bef1-042c1332ee42",
        "indicator--d2f3f820-5cef-4b32-9d54-bdeb755d387a",
        "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
        "indicator--e3c55c18-aac4-41e5-9636-95b3dc104146",
        "indicator--0a500bc8-a868-42af-9f7f-f4272fdceaff",
        "indicator--3a2a9a89-6468-4873-a1bb-914649eba072",
        "indicator--88ab386b-319d-4876-a81e-24cf9706edb9",
        "indicator--c4586dd1-428c-4eac-b95e-fb125a35e5c2",
        "indicator--44f49992-3c0b-4ef1-abea-6d8343d74c35",
        "indicator--801a6f21-ea4f-4df1-a892-808dc1781d05",
        "indicator--b2c2671f-d671-49ad-96fb-b09971b95d29",
        "indicator--7ac4cd6f-c46a-4b7c-94e5-0c3db926544d",
        "indicator--997566b1-263e-480d-b9ef-3fd2263ef472",
        "indicator--e6119f5e-5d3a-41ee-9422-3097e0b143ec",
        "indicator--8ab513d9-5355-42bc-9d20-ac752da93658",
        "indicator--45e731e0-09de-4e3c-8ae3-5fb768947acb",
        "indicator--92b101c8-f419-44f3-b7b2-587e2bf497ae",
        "indicator--27d25e15-32be-4fb8-880c-7e8f7b8d6ea1",
        "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
        "indicator--acf0658c-57d8-4aea-a53f-30508f797868",
        "indicator--0043a4a1-1e79-4a61-9d3c-fd72b61968dd",
        "indicator--525d7579-60e1-4556-9482-a0d5cde7138b",
        "indicator--d35099bc-9f59-4d81-90ed-a9e8fbe6580e",
        "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
        "indicator--1b88c49e-80f0-4e3f-b8b1-5867775055e4",
        "indicator--2ec5e1f2-58ce-45fb-85da-32a60942a97a",
        "indicator--ba9abb90-ed2f-4571-8b05-2d8330ff80d2",
        "indicator--e96eebbf-6e8d-4095-a4f1-386e019b9e3b",
        "indicator--dc450676-75a4-42a5-bac6-f11b1b8fe343",
        "indicator--087dc3ef-7fcd-413f-81bc-67ed87ad4eb0",
        "indicator--65801a64-9a80-4a71-9b78-1e1016e3cf55",
        "indicator--a2214726-6cb0-4622-a4c8-dcff5c8143b1",
        "indicator--f13569e5-99ca-4c96-9ab2-3bb73e7e7fcd",
        "indicator--701d1d15-08ad-4d78-b954-e0a2e9fc4774",
        "indicator--1a3f94ac-1c99-43de-821d-4587cfda7b0b",
        "indicator--fffc992e-8a59-4c6d-8fa7-65b315c63804",
        "indicator--689d27bf-86ff-466b-a301-a5cae01ee7b1",
        "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
        "indicator--4451fc7b-8d49-4eeb-8077-a34327ca0465",
        "indicator--8d269a83-5f66-4db6-8eb8-eb2c10a0d6c2",
        "indicator--9c2baa02-3edd-4ce2-a57d-3c3c33d4cd88",
        "indicator--6ce3a868-928e-4c0f-92eb-4286132a49d0",
        "indicator--ddea1711-d78c-4a43-a12d-ac556498231b",
        "indicator--26772517-d9af-4287-86c8-7ae2b129db0e",
        "indicator--aa9aa233-a5cd-42ae-90e6-0713e10b3af4",
        "indicator--3c268658-eba8-4d96-8d7a-0640fb16125c",
        "indicator--f660c869-fe96-4b8d-8e4d-abeed329415f",
        "indicator--00c84f93-4d9f-435a-8476-6f92aa8de056",
        "indicator--4d47bab5-84ba-4269-8160-92cafd4a1457",
        "indicator--f4004b12-5c33-4b45-a76e-9280014061f9",
        "indicator--28059ef0-e53b-4d01-aeb0-c8f96c7e34aa",
        "indicator--29becdfc-0443-45f2-b245-687a3f8c4de9",
        "indicator--d1c5b09a-13ac-4c3a-8410-260df1212763",
        "indicator--3b2c6f67-b10c-4633-a6e1-e5dd10ebd70f",
        "indicator--1f1ae56b-bdf7-4db0-86a3-d21fc2b65c63",
        "indicator--6e534859-cb57-44a1-86a6-d46493556f55",
        "indicator--87e1db3c-5dd7-4f8f-a275-7ad6aeb3143d",
        "indicator--ae636ef5-7d88-4dc6-9e19-0eecbe7e75b9",
        "indicator--1a04471f-7e8d-4712-a8e6-eeb57baa389f",
        "indicator--43bc1f97-080c-4f44-850e-d839e27d2c0b",
        "indicator--24883be8-5273-4281-ae70-7ac8f491a958",
        "indicator--696e249a-873f-4c88-b2e8-a62cce7ab97b",
        "indicator--cffed29c-ba0c-4f1d-b054-f990229a3a41",
        "indicator--27803893-2a9e-42c0-be92-9e86e0fec10f",
        "indicator--e314a1a9-8479-48b7-b96e-29eec4562aca",
        "indicator--7d13ebdf-6590-4c39-affe-5d83cee1b10f",
        "indicator--38171049-92c5-4d42-9a76-c1294ab3d593",
        "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
        "indicator--c640580c-383a-481c-af3f-c8a1d25269ec",
        "indicator--d47c865e-75bd-4a0b-8f13-9891dd8f3953",
        "indicator--d4350190-69e8-42e9-8705-8912a44c02b3",
        "indicator--b49141f3-d7e7-4f7b-b1ee-f1ef1d3904ce",
        "indicator--044cbf55-dca4-4e17-8306-7a447c9a3e3a",
        "indicator--861762b0-bfd7-499c-a0fc-f7762621dfc2",
        "indicator--7fd54a9f-8977-4304-bc62-af73db169f9a",
        "indicator--3c55ef4d-6680-4cba-b816-0dda62ac3100",
        "indicator--82c117b1-10e4-49c3-9dde-572f15a4fa7c",
        "indicator--99c29f3b-fcb7-429e-ba40-6a125cd5591d",
        "indicator--3dbe1135-2998-4969-a1dd-c45b39f42f25",
        "indicator--3920e92d-bc1e-4dc2-8e5b-ab61247e43d0",
        "indicator--48ad820d-0ef4-495f-8514-9cfbc5139151",
        "indicator--a491b86b-e944-4e6b-85e3-32940586a1b1",
        "indicator--93a004db-cf6c-4161-8c97-0baa802327eb",
        "indicator--bc593a93-492b-439c-924b-0488e70c8f67",
        "indicator--26406a51-9c03-4993-890e-0a6ae256c54c",
        "indicator--b2d0e7c8-ad42-4ef1-b050-2bcdb176eaeb",
        "indicator--c7904438-0531-4eb8-90dc-411e677d9596",
        "indicator--12db5d2f-df0c-4ad5-9e22-ac8eb5611d4a",
        "indicator--467af180-31e5-418d-bbe1-29ea089e4574",
        "indicator--e7dca12f-44fc-4b50-b156-9873221f348e",
        "indicator--50a8de5f-3d07-4bd2-984e-d5c97d575021",
        "indicator--0994d90a-d181-468e-9a41-c8e20965d175",
        "indicator--e2035372-83d0-4bef-bf06-052439dac9cf",
        "indicator--6388b17c-e9af-426b-9ad5-327b5021b6b5",
        "indicator--cb630de5-e04e-469f-b77a-84dc257473a7",
        "indicator--77cfed09-a65a-43ae-918f-652bfd1d104a",
        "indicator--e51bf591-61c6-4386-88b9-b4240b2a7423",
        "indicator--9aa33267-ad50-4077-8288-92bb8584a304",
        "indicator--856c9e19-a57e-46dd-b357-d7555848a2aa",
        "indicator--3edb8c59-23fe-4366-8639-40173e30cc23",
        "indicator--b8c02af2-9a1d-4f81-a70f-1085dbe40ccf",
        "indicator--e134a606-ce39-48ca-b36b-34f7b0548f90",
        "indicator--649a04ad-78c7-43f2-8eaf-92ab9678fd80",
        "indicator--6b0da8bc-1783-498f-aea6-3fb99a4a9a7e",
        "indicator--3bb54411-21f2-4777-a4a4-396203066ef1",
        "indicator--85d1793a-8ccf-48c5-8fd6-ec87668cb5c6",
        "indicator--6a6df85f-1ae3-4665-a570-9bd882faae27",
        "indicator--431f9741-0ef0-41f3-ae78-5ba1c7a496e9",
        "indicator--9ca33123-5392-449b-a8ba-0404cebfe330"
      ],
      "published": "2026-05-01T00:05:02.650Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-05-01T00:05:02.650Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-05-01T00:05:02.650Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=142319; asn_org=PT Telemedia Komunikasi Pratama",
      "id": "indicator--f4087da3-0776-4dcf-83d6-e29bcf9bc87d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.186.35.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z"
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c94d4f92-eeec-42cc-a4bf-f302b30a8329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.199.240.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T04:08:41.348Z",
      "x_nadsec_last_seen": "2026-05-06T04:08:41.348Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--1d9296bb-381e-4d4f-956a-058abc514046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.86.88.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-02T11:04:27.178Z",
      "x_nadsec_last_seen": "2026-05-02T20:09:05.633Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--58a1cee7-e7c0-489d-b353-cd2ebe756aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.250.196.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z"
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=US; asn=22773; asn_org=Cox Communications Inc.",
      "id": "indicator--361833b2-f290-4eab-a775-1ca6a6e48336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.234.142.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T21:10:08.627Z",
      "x_nadsec_last_seen": "2026-05-31T21:16:39.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22773"
      ],
      "x_nadsec_orgs": [
        "Cox Communications Inc."
      ]
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bcddb3b5-1a58-42e1-9d1e-76c3583d1d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T04:39:56.139Z",
      "x_nadsec_last_seen": "2026-05-05T04:40:06.298Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f805a635-fb27-4be9-bfee-4ebbbaa82a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-05-03T14:35:42.249Z",
      "x_nadsec_last_seen": "2026-05-30T20:04:03.375Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--495e4692-5043-4b44-a343-2eabc6f48026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T16:50:25.636Z",
      "x_nadsec_last_seen": "2026-05-28T02:34:44.900Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--851e8e4e-ebcd-4a63-b8f0-51379c4ad985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.8.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:05:03.000Z",
      "valid_until": "2026-06-02T00:05:01.000Z"
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network",
      "id": "indicator--ac3edd71-6bc7-40e3-ba84-eb79bb7a0b1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.75.13.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z"
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=31263; asn_org=Mynet S.r.l.",
      "id": "indicator--b7b673fb-3a3c-43a8-840b-16661a0a6343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.175.244.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z"
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--59ce74f1-a7c9-402b-9317-c01c2778fa0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.233.100.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z"
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GT; asn=52468; asn_org=UFINET PANAMA S.A.; user(top)=**",
      "id": "indicator--6d82d65b-ea0d-47a2-9d16-4c4326bb860b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.115.5.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T15:17:47.544Z",
      "x_nadsec_last_seen": "2026-05-12T03:58:17.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GT"
      ],
      "x_nadsec_asns": [
        "52468"
      ],
      "x_nadsec_orgs": [
        "UFINET PANAMA S.A."
      ]
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z",
      "x_nadsec_event_count": 112,
      "x_nadsec_first_seen": "2026-05-03T13:38:28.165Z",
      "x_nadsec_last_seen": "2026-05-25T00:59:49.814Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T21:22:41.211Z",
      "x_nadsec_last_seen": "2026-05-31T21:22:41.211Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JM; asn=10292; asn_org=Cable & Wireless Jamaica",
      "id": "indicator--549217c1-f84d-4cd6-98b4-2d7e014f1033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '208.163.34.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z"
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--43a23d69-8701-47d4-8d86-8afaea18b436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T00:48:54.317Z",
      "x_nadsec_last_seen": "2026-05-15T00:48:54.317Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--92e7b3ed-653c-4217-88ce-477c29a7caf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:05:05.000Z",
      "valid_until": "2026-06-02T01:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T15:41:17.225Z",
      "x_nadsec_last_seen": "2026-05-27T22:32:02.814Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-01T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=LT; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--fdfc767d-3012-402a-84b1-f55acece7c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.36.81.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:05:10.000Z",
      "valid_until": "2026-06-02T02:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-11T01:13:48.118Z",
      "x_nadsec_last_seen": "2026-05-31T19:30:25.994Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-05-01T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--b64049c1-182d-42a4-9c08-92782c077293",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:05:10.000Z",
      "valid_until": "2026-06-02T02:05:09.000Z"
    },
    {
      "created": "2026-05-01T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--644666b5-a032-4624-9175-da86c1ba3729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.55.35.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:05:10.000Z",
      "valid_until": "2026-06-02T02:05:09.000Z"
    },
    {
      "created": "2026-05-01T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--a2537d33-5997-4c97-a37c-6d3591dd0630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:05:10.000Z",
      "valid_until": "2026-06-02T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T05:24:57.603Z",
      "x_nadsec_last_seen": "2026-05-21T00:19:32.977Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB",
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--ff136fdd-d4da-4010-aa28-50a8b37c4b77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:05:10.000Z",
      "valid_until": "2026-06-02T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T03:28:36.505Z",
      "x_nadsec_last_seen": "2026-05-29T20:29:10.591Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:05:10.000Z",
      "valid_until": "2026-06-02T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T04:38:50.804Z",
      "x_nadsec_last_seen": "2026-05-30T08:33:29.595Z",
      "x_nadsec_ports": [
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:05:02.000Z",
      "valid_until": "2026-06-02T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T18:27:32.632Z",
      "x_nadsec_last_seen": "2026-05-30T18:27:32.632Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=4618; asn_org=Internet Thailand Company Limited",
      "id": "indicator--8ea34d3c-c7f9-445b-8c6e-c52d93b3429f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.154.89.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:05:02.000Z",
      "valid_until": "2026-06-02T03:05:00.000Z"
    },
    {
      "created": "2026-05-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=214664; asn_org=JSC Buduschee",
      "id": "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:05:02.000Z",
      "valid_until": "2026-06-02T03:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T10:33:19.930Z",
      "x_nadsec_last_seen": "2026-05-26T22:17:22.499Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "214664"
      ],
      "x_nadsec_orgs": [
        "JSC Buduschee"
      ]
    },
    {
      "created": "2026-05-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--44a3e561-7aff-4861-8d2f-ede61e2e82d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:05:02.000Z",
      "valid_until": "2026-06-02T03:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-03T11:02:43.461Z",
      "x_nadsec_last_seen": "2026-05-29T21:46:43.342Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f0dc03fb-1b23-4966-9013-b967f8d1b984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:05:02.000Z",
      "valid_until": "2026-06-02T03:05:00.000Z"
    },
    {
      "created": "2026-05-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6e69138a-5438-4adb-a1b3-f468d63c522e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:05:02.000Z",
      "valid_until": "2026-06-02T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T13:46:28.519Z",
      "x_nadsec_last_seen": "2026-05-04T13:46:28.519Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-01T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cc08ac73-f902-4d9f-ae50-a69f01550c4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.249.178.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:05:02.000Z",
      "valid_until": "2026-06-02T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T08:00:18.101Z",
      "x_nadsec_last_seen": "2026-05-03T08:00:18.101Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f9c4c21e-2b2b-4f21-aa85-e734a1c82232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:13:16.212Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:31.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b14d71db-65fc-4a86-a62e-469c0f1f367e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:12:51.563Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:12.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--3d9735df-879b-4019-a3fb-d2c966e4099e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T04:12:53.303Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:35.819Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ef130b56-9060-487c-b4dc-4a7a6bd6e568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-20T04:13:19.412Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:48.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--a9a6b920-36c9-4f66-8990-8c3bb10c9269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:13:06.465Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:28.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8ae986bb-bcf0-4a2f-bf53-edf47951fffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T04:13:14.480Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:14.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--0fa2c768-e83d-4109-929a-c34f226230cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:13:01.321Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:21.153Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--64f1ba26-6cca-46c8-82b6-63a3fae9d5a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--305bf0b6-974a-414e-a967-57b61403f65d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:12:56.460Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:37.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d1d0d699-e6cf-4155-9f60-fec036734202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T04:13:17.591Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:17.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8e71ffee-5471-4ccf-8929-0a64e3c22567",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T04:13:10.613Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:44.675Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--004562f3-3435-4d02-9220-c40e55934492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T04:13:35.421Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:49.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=27; services=ftpd; ports=21; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--95b057b1-f33e-4cad-b884-ea1b1d9dcd2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f8fdc7d6-16c2-41ce-a6f6-0d0db072d575",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.134.216.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 40,
      "x_nadsec_first_seen": "2026-05-06T03:29:44.104Z",
      "x_nadsec_last_seen": "2026-05-23T17:19:31.512Z",
      "x_nadsec_ports": [
        "3306",
        "1433",
        "1723",
        "27017",
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mssqld",
        "mongod",
        "pptpd",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--78209a8a-b0b0-4f6e-97fd-39c2dfd126c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.195.32.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--f5b669d5-17fd-4f76-a359-0e3e069a8114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.241.145.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--91d6d891-f837-4d53-903c-a08d6e4b0b52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T14:51:12.012Z",
      "x_nadsec_last_seen": "2026-05-26T14:41:18.405Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "pptpd",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-01T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:05:09.000Z",
      "valid_until": "2026-06-02T04:05:08.000Z"
    },
    {
      "created": "2026-05-01T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3031174d-685c-47cd-8a0f-10fb80c13297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:05:10.000Z",
      "valid_until": "2026-06-02T05:05:09.000Z"
    },
    {
      "created": "2026-05-01T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--14e0aab9-ddc5-4eaa-838a-8a1dfb821820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.150.115.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:05:10.000Z",
      "valid_until": "2026-06-02T05:05:09.000Z"
    },
    {
      "created": "2026-05-01T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--85de7e57-9c00-4f05-b4fb-e6c8ab751600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:05:10.000Z",
      "valid_until": "2026-06-02T05:05:09.000Z"
    },
    {
      "created": "2026-05-01T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:05:10.000Z",
      "valid_until": "2026-06-02T05:05:09.000Z",
      "x_nadsec_event_count": 108,
      "x_nadsec_first_seen": "2026-05-02T15:48:06.664Z",
      "x_nadsec_last_seen": "2026-05-22T17:07:59.669Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "3306",
        "1433",
        "1723",
        "81",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "mysqld",
        "mssqld",
        "pptpd",
        "httpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-01T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:05:10.000Z",
      "valid_until": "2026-06-02T05:05:09.000Z",
      "x_nadsec_event_count": 90,
      "x_nadsec_first_seen": "2026-05-02T02:37:00.416Z",
      "x_nadsec_last_seen": "2026-05-24T03:21:55.072Z",
      "x_nadsec_ports": [
        "27017",
        "3306",
        "81",
        "1723",
        "445",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "httpd",
        "pptpd",
        "smbd",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-01T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:05:10.000Z",
      "valid_until": "2026-06-02T05:05:09.000Z",
      "x_nadsec_event_count": 68,
      "x_nadsec_first_seen": "2026-05-02T17:31:16.965Z",
      "x_nadsec_last_seen": "2026-05-20T03:17:13.121Z",
      "x_nadsec_ports": [
        "1433",
        "81",
        "27017",
        "445",
        "3306",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "httpd",
        "mongod",
        "mysqld",
        "smbd",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-01T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2fb22ffe-9119-4ca0-862e-975cc4d4791d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:05:10.000Z",
      "valid_until": "2026-06-02T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T09:00:03.839Z",
      "x_nadsec_last_seen": "2026-05-11T09:00:04.180Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a02c985f-4493-4416-88d0-a13f0cce4756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.45.63.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z"
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=135905; asn_org=VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "id": "indicator--b8d0fddf-74ea-4d90-899b-1410132acbb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.225.19.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z"
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--14365e00-ee22-4b56-8846-525b4c20dcc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.134.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z"
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--416de007-bc76-4bf9-a51c-f8ade13ee56b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.201.202.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z"
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--93131b20-04b2-4956-bd1b-b0284c7c43c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z"
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--adbef988-1363-430c-a366-edbc47c44aa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z"
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--d11578f8-dc37-4e7c-bf13-41662a7c2447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-03T10:19:39.843Z",
      "x_nadsec_last_seen": "2026-05-28T05:24:21.651Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-01T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fb0feada-6351-4582-ac15-b83bc47c0289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:05:11.000Z",
      "valid_until": "2026-06-02T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T03:36:23.885Z",
      "x_nadsec_last_seen": "2026-05-03T03:36:25.233Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=136180; asn_org=Beijing Tiantexin Tech. Co., Ltd.",
      "id": "indicator--644f511c-ad18-41de-a645-5310b8d3d4b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-02T13:54:42.936Z",
      "x_nadsec_last_seen": "2026-05-31T09:41:07.810Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136180"
      ],
      "x_nadsec_orgs": [
        "Beijing Tiantexin Tech. Co., Ltd."
      ]
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=153252; asn_org=ELXIRE",
      "id": "indicator--0704d7be-b3a6-48d9-9b88-344eb49786a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.220.30.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z"
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0bfb9f0e-65c1-4e20-bd9d-a38eb9ee5279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.178.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z"
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--aea34727-57cc-4263-881d-028e5b151202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.244.61.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z"
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=JO; asn=50670; asn_org=Vtel Holdings Limited/jordan Co.",
      "id": "indicator--4ea7e188-c4af-4e3e-a346-69f25a961a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.96.68.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z"
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f1c8a72b-df47-46c8-b945-c8944eae3a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T21:46:09.285Z",
      "x_nadsec_last_seen": "2026-05-29T21:46:09.285Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4c41511a-3b22-4e50-a8a6-3944386b89a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.1.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z"
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PK; asn=205759; asn_org=Ghosty Networks LLC",
      "id": "indicator--b361146d-529f-4b72-b6d5-1aa8c078a49c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z",
      "x_nadsec_event_count": 26,
      "x_nadsec_first_seen": "2026-05-05T01:23:28.605Z",
      "x_nadsec_last_seen": "2026-05-29T20:08:57.374Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ]
    },
    {
      "created": "2026-05-01T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--8ef57ea5-eb00-436e-b433-807a9ebfd04e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.228.168.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:05:10.000Z",
      "valid_until": "2026-06-02T07:05:08.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-05-09T22:35:31.336Z",
      "x_nadsec_last_seen": "2026-05-20T14:47:42.877Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MZ; asn=25139; asn_org=Comunicacoes Multimedia, Lda; user(top)=**",
      "id": "indicator--ffa3335b-41cc-4926-8316-eb8dcf7a144e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.249.255.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--364dc00d-b531-4692-ab69-6e0974d4e3df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.80.105.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T08:16:24.099Z",
      "x_nadsec_last_seen": "2026-05-21T11:34:32.092Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T08:16:24.108Z",
      "x_nadsec_last_seen": "2026-05-21T11:34:23.208Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T08:16:24.701Z",
      "x_nadsec_last_seen": "2026-05-08T08:16:24.701Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T08:16:25.266Z",
      "x_nadsec_last_seen": "2026-05-08T08:16:25.266Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--81622e92-e58f-4443-b940-41bfcb8c908e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=47702; asn_org=Teleradiocompany Discovery Ltd.; user(top)=**",
      "id": "indicator--b1280161-3eb6-43da-857f-4326ccdc7b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.109.232.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T19:18:07.964Z",
      "x_nadsec_last_seen": "2026-05-04T19:18:07.964Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "47702"
      ],
      "x_nadsec_orgs": [
        "Teleradiocompany Discovery Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--16094e33-2657-4334-9039-03ee4f15fabf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.14.23.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--35818390-bb6e-467b-ba16-b2b44a0e79c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.196.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T15:58:54.573Z",
      "x_nadsec_last_seen": "2026-05-18T23:41:24.379Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--00a64800-7b0d-4ff6-882d-7f054edc53b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.228.3.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--d52f0262-f166-4536-9a45-fe5981be7edb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-04T05:05:34.460Z",
      "x_nadsec_last_seen": "2026-05-29T18:45:40.739Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=26554; asn_org=US Signal Company, L.L.C.",
      "id": "indicator--f8ef1f19-b447-4cd8-ad7b-2c83a94e8c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.141.143.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--cbb0b81e-0416-4a30-a7fa-f71803ed61a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T14:31:16.589Z",
      "x_nadsec_last_seen": "2026-05-05T21:32:36.250Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-07T11:13:42.783Z",
      "x_nadsec_last_seen": "2026-05-24T12:29:25.867Z",
      "x_nadsec_ports": [
        "445",
        "81"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--29b3442f-f06a-48d9-9acf-5c1876ccc730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.126.124.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=41631; asn_org=Comfo LTD",
      "id": "indicator--cebc0e32-8d9c-41f5-b046-781c14cfbe2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.158.153.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:05:08.000Z",
      "valid_until": "2026-06-02T08:05:03.000Z"
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4d966dbd-d3ba-4526-9892-b30e90064d66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.1.132.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T04:43:32.182Z",
      "x_nadsec_last_seen": "2026-05-24T04:43:32.182Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ed938d28-aeb4-4795-abb9-d3fecb6e0bed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T09:50:26.401Z",
      "x_nadsec_last_seen": "2026-05-16T09:50:26.401Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f116d4ca-669c-48ba-8f44-60c888f4eebb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T23:26:13.150Z",
      "x_nadsec_last_seen": "2026-05-20T23:26:13.150Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--3b9029da-b6a8-4e48-9e52-37487ba7c763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.47.56.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z"
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T17:18:29.184Z",
      "x_nadsec_last_seen": "2026-05-03T17:18:29.184Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--a273f10f-9da5-4919-ba54-14ab97ccb19b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z"
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--d2eac234-db9f-4cb5-b7c8-76dbfcb4dc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z"
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z"
    },
    {
      "created": "2026-05-01T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--c4ffa596-736f-4ab1-ac2e-2a0416435b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:05:10.000Z",
      "valid_until": "2026-06-02T09:05:09.000Z"
    },
    {
      "created": "2026-05-01T10:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--29df78dc-5d9c-403a-bd85-2e105be52f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.138.18.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:05:20.000Z",
      "valid_until": "2026-06-02T10:05:08.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-05-02T15:20:54.051Z",
      "x_nadsec_last_seen": "2026-05-31T05:45:57.921Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T10:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=46606; asn_org=Unified Layer",
      "id": "indicator--c7ef3755-2dd2-4e50-b4e0-09751b6f4912",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.215.135.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:05:20.000Z",
      "valid_until": "2026-06-02T10:05:08.000Z"
    },
    {
      "created": "2026-05-01T10:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--81012e04-51f5-411b-afe9-68b78baf33cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:05:20.000Z",
      "valid_until": "2026-06-02T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T07:06:14.051Z",
      "x_nadsec_last_seen": "2026-05-11T11:33:34.332Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-01T10:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--55170144-605c-4026-8788-3f7f9eb009b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:05:20.000Z",
      "valid_until": "2026-06-02T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T08:34:21.700Z",
      "x_nadsec_last_seen": "2026-05-02T08:34:21.700Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-01T10:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--086bf9db-e094-4ac4-b0ef-c1b22dd7425f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:05:20.000Z",
      "valid_until": "2026-06-02T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T01:58:31.955Z",
      "x_nadsec_last_seen": "2026-05-26T01:58:31.955Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-01T10:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--dc01f7ac-fb03-4d1b-a8e2-27371d09004d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.233.21.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:05:20.000Z",
      "valid_until": "2026-06-02T10:05:08.000Z"
    },
    {
      "created": "2026-05-01T10:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f8450206-7cc4-4008-81d7-91077407de2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T10:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:05:20.000Z",
      "valid_until": "2026-06-02T10:05:08.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-05-10T03:00:38.332Z",
      "x_nadsec_last_seen": "2026-05-29T06:45:41.894Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-01T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--013694d9-6b42-4300-8a48-b5bcabd021c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.119.96.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:05:04.000Z",
      "valid_until": "2026-06-02T11:05:03.000Z"
    },
    {
      "created": "2026-05-01T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--12b25a76-45c8-428c-86b1-0b2b07a73327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.9.34.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:05:04.000Z",
      "valid_until": "2026-06-02T11:05:03.000Z"
    },
    {
      "created": "2026-05-01T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=48090; asn_org=Techoff Srv Limited",
      "id": "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:05:04.000Z",
      "valid_until": "2026-06-02T11:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T14:06:49.539Z",
      "x_nadsec_last_seen": "2026-05-26T13:46:18.949Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "48090"
      ],
      "x_nadsec_orgs": [
        "Techoff Srv Limited"
      ]
    },
    {
      "created": "2026-05-01T11:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T11:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:05:04.000Z",
      "valid_until": "2026-06-02T11:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T12:26:15.269Z",
      "x_nadsec_last_seen": "2026-05-23T10:52:16.037Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-01T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--66ce8deb-e862-4af9-b618-f7baeca06ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.172.100.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:05:10.000Z",
      "valid_until": "2026-06-02T12:05:09.000Z"
    },
    {
      "created": "2026-05-01T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=60223; asn_org=Netiface Limited",
      "id": "indicator--45f7dc4b-c52e-4fc8-9a8e-b524ff66b782",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.3.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:05:10.000Z",
      "valid_until": "2026-06-02T12:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-04T20:30:20.974Z",
      "x_nadsec_last_seen": "2026-05-28T22:09:41.468Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "60223"
      ],
      "x_nadsec_orgs": [
        "Netiface Limited"
      ]
    },
    {
      "created": "2026-05-01T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:05:10.000Z",
      "valid_until": "2026-06-02T12:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-02T05:29:42.978Z",
      "x_nadsec_last_seen": "2026-05-31T17:36:20.425Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "1723",
        "3306",
        "42",
        "135",
        "445",
        "34843"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mysqld",
        "pptpd",
        "epmapper",
        "mirrorc",
        "mirrord",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-05-01T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--06ddbb67-61dc-42e9-81f5-19ca056d14df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.136.195.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:05:09.000Z",
      "valid_until": "2026-06-02T13:05:08.000Z"
    },
    {
      "created": "2026-05-01T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0b806cf4-2933-48b3-b118-189f8eb807f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.2.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:05:09.000Z",
      "valid_until": "2026-06-02T13:05:08.000Z"
    },
    {
      "created": "2026-05-01T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:05:09.000Z",
      "valid_until": "2026-06-02T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T00:54:45.930Z",
      "x_nadsec_last_seen": "2026-05-27T02:38:35.111Z",
      "x_nadsec_ports": [
        "3306",
        "21",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-01T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--03a657e1-84a2-4ef6-aeb7-b47d1890f246",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.247.206.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:05:09.000Z",
      "valid_until": "2026-06-02T13:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-08T06:36:31.419Z",
      "x_nadsec_last_seen": "2026-05-29T14:08:26.331Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-01T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.89.204.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:05:09.000Z",
      "valid_until": "2026-06-02T13:05:08.000Z"
    },
    {
      "created": "2026-05-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1382; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9b5529a0-2d46-4ca0-9f71-00d3dac48050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.80.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:05:10.000Z",
      "valid_until": "2026-06-02T14:05:09.000Z"
    },
    {
      "created": "2026-05-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--43f9105c-f0f3-4557-906d-37b0b300b877",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:05:10.000Z",
      "valid_until": "2026-06-02T14:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-02T14:52:50.008Z",
      "x_nadsec_last_seen": "2026-05-11T22:26:20.564Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--f0ce9a3d-f37e-4689-8599-57a1338a9a1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:05:10.000Z",
      "valid_until": "2026-06-02T14:05:09.000Z"
    },
    {
      "created": "2026-05-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:05:10.000Z",
      "valid_until": "2026-06-02T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T14:21:01.810Z",
      "x_nadsec_last_seen": "2026-05-17T12:54:00.270Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:05:10.000Z",
      "valid_until": "2026-06-02T14:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-03T15:55:34.495Z",
      "x_nadsec_last_seen": "2026-05-07T18:13:59.028Z",
      "x_nadsec_ports": [
        "1883",
        "445",
        "27017",
        "21",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "smbd",
        "epmapper",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210259"
      ],
      "x_nadsec_orgs": [
        "LLC Applied Computational Technologies"
      ]
    },
    {
      "created": "2026-05-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--4b1ed4f3-4134-4025-9a50-b83352f4bb68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:05:10.000Z",
      "valid_until": "2026-06-02T14:05:09.000Z"
    },
    {
      "created": "2026-05-01T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=21299; asn_org=Kar-Tel LLC",
      "id": "indicator--cfbde833-c48d-425e-b5e5-26bd035277fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.55.173.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:05:10.000Z",
      "valid_until": "2026-06-02T14:05:09.000Z"
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--97804ff2-6c0d-4a6b-8e0b-2ca023a2a5f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.185.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z"
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z",
      "x_nadsec_event_count": 77,
      "x_nadsec_first_seen": "2026-05-03T04:04:04.830Z",
      "x_nadsec_last_seen": "2026-05-23T16:45:23.485Z",
      "x_nadsec_ports": [
        "3306",
        "445",
        "1723",
        "81",
        "1433",
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "pptpd",
        "httpd",
        "mongod",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=56889; asn_org=TTC Radiotechnika LTD",
      "id": "indicator--166cc92d-58fc-41bb-8570-5b5b06726323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.131.80.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z"
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--e96f9b96-a676-48d3-8250-a994d28fc8d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.38.211.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z"
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-04T15:26:38.590Z",
      "x_nadsec_last_seen": "2026-05-31T14:51:27.372Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1723",
        "81"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "pptpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--3c3195c9-6355-4cd5-bdae-2146b5ece70a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T12:42:48.242Z",
      "x_nadsec_last_seen": "2026-05-10T12:42:48.242Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--216f28ac-ec98-472f-a2b3-f3e4fc70709f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z"
    },
    {
      "created": "2026-05-01T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--6db49d8c-94b7-4925-96ff-116599121978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:05:09.000Z",
      "valid_until": "2026-06-02T15:05:08.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-03T12:46:47.460Z",
      "x_nadsec_last_seen": "2026-05-30T04:52:09.223Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--67f7fbac-cb4d-49e3-b4e6-af52f6c06fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.209.98.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z"
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T15:06:19.204Z",
      "x_nadsec_last_seen": "2026-05-24T05:11:04.127Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--737c298e-b791-4da6-b1bc-494a23a45b76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z"
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z"
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--584cf865-d0e0-4d3c-9329-d0860fbc0f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.171.9.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z"
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--07243cf2-0793-4c7b-baed-4152f2fe4e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-02T09:16:09.888Z",
      "x_nadsec_last_seen": "2026-05-06T07:24:00.442Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-02T14:11:29.704Z",
      "x_nadsec_last_seen": "2026-05-25T12:31:19.740Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-01T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=44983; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b75bcf58-fbde-4c16-b2c1-5c95c306995f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:05:10.000Z",
      "valid_until": "2026-06-02T16:05:09.000Z"
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132116; asn_org=Ani Network Pvt Ltd",
      "id": "indicator--a8a18360-02a6-40a3-a704-2882d23b5a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.40.200.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z"
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--814414b9-2821-4888-9437-f856a98f5dad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z"
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--2817f030-a4f3-486f-93d6-9693f5d9fc4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.134.32.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z"
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--85da3d13-e04a-4eea-9a7c-b1e64b628731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T00:33:19.396Z",
      "x_nadsec_last_seen": "2026-05-27T00:33:29.556Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8f07dbd4-1126-4562-9ae3-580fd964c89b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.219.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z"
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z",
      "x_nadsec_event_count": 115,
      "x_nadsec_first_seen": "2026-05-02T16:11:48.993Z",
      "x_nadsec_last_seen": "2026-05-23T17:11:27.231Z",
      "x_nadsec_ports": [
        "81",
        "1723",
        "3306",
        "27017",
        "445",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd",
        "mysqld",
        "mongod",
        "smbd",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-11T01:37:26.198Z",
      "x_nadsec_last_seen": "2026-05-27T09:03:26.310Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "21",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "ftpd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--806cd735-d8da-4cf2-a93f-fd8ba8dcb922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T11:56:00.829Z",
      "x_nadsec_last_seen": "2026-05-20T11:56:00.833Z",
      "x_nadsec_ports": [
        "42",
        "33899"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-01T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d5d8e328-c3bb-424a-8091-c318abf89970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:05:09.000Z",
      "valid_until": "2026-06-02T17:05:09.000Z"
    },
    {
      "created": "2026-05-01T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--28e7d3df-eb96-4ec5-b8b3-cd42398c8165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.230.60.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:05:11.000Z",
      "valid_until": "2026-06-02T18:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T22:41:13.995Z",
      "x_nadsec_last_seen": "2026-05-05T22:41:13.995Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--8dc611dd-03ab-46b5-aeea-f2b5dfa69fa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.100.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:05:11.000Z",
      "valid_until": "2026-06-02T18:05:10.000Z"
    },
    {
      "created": "2026-05-01T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--ece11683-82d0-4ed7-83d7-718ebf5c0899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.104.45.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:05:11.000Z",
      "valid_until": "2026-06-02T18:05:10.000Z"
    },
    {
      "created": "2026-05-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--7cc63782-c963-427d-b6ea-9557be1b95ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.240.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:05:10.000Z",
      "valid_until": "2026-06-02T19:05:09.000Z"
    },
    {
      "created": "2026-05-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--99f4fa97-c5be-4e1d-8972-2c8264fdfe6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.44.123.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:05:10.000Z",
      "valid_until": "2026-06-02T19:05:09.000Z"
    },
    {
      "created": "2026-05-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--df824ff9-8b39-433d-8121-3cefb873ae8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.211.118.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:05:10.000Z",
      "valid_until": "2026-06-02T19:05:09.000Z",
      "x_nadsec_event_count": 322,
      "x_nadsec_first_seen": "2026-05-02T04:58:02.340Z",
      "x_nadsec_last_seen": "2026-05-02T19:15:19.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-01T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=216473; asn_org=Bashinskii Vadim Ruslanovich",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:05:10.000Z",
      "valid_until": "2026-06-02T19:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-05T20:50:43.486Z",
      "x_nadsec_last_seen": "2026-05-31T21:39:11.383Z",
      "x_nadsec_ports": [
        "1433",
        "81"
      ],
      "x_nadsec_services": [
        "mssqld",
        "httpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "216473"
      ],
      "x_nadsec_orgs": [
        "Bashinskii Vadim Ruslanovich"
      ]
    },
    {
      "created": "2026-05-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--89f62eb1-563d-46c7-be77-b57faaaf7ee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.131.100.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:05:10.000Z",
      "valid_until": "2026-06-02T20:05:09.000Z"
    },
    {
      "created": "2026-05-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:05:10.000Z",
      "valid_until": "2026-06-02T20:05:09.000Z",
      "x_nadsec_event_count": 81,
      "x_nadsec_first_seen": "2026-05-04T16:21:44.968Z",
      "x_nadsec_last_seen": "2026-05-21T15:01:44.419Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "27017",
        "81",
        "1723",
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld",
        "mongod",
        "httpd",
        "mysqld",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48547; asn_org=Mac Tower Ltd",
      "id": "indicator--4d8ff91c-38a4-4e70-925d-27e2bdbd6830",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.49.51.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:05:10.000Z",
      "valid_until": "2026-06-02T20:05:09.000Z"
    },
    {
      "created": "2026-05-01T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e7f7536b-639d-433a-99bf-6a36d64b71ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.41.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:05:10.000Z",
      "valid_until": "2026-06-02T20:05:09.000Z"
    },
    {
      "created": "2026-05-01T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED",
      "id": "indicator--042c07c1-734a-4d03-8b17-e2ffe654fa38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.27.108.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:05:09.000Z",
      "valid_until": "2026-06-02T21:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T23:11:38.111Z",
      "x_nadsec_last_seen": "2026-05-16T23:11:48.562Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ]
    },
    {
      "created": "2026-05-01T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=45899; asn_org=VNPT Corp; user(top)=**",
      "id": "indicator--4263dd6b-4663-4bcf-8581-c3afad8175c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.30.233.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:05:09.000Z",
      "valid_until": "2026-06-02T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T20:47:23.538Z",
      "x_nadsec_last_seen": "2026-05-25T18:58:52.223Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d45c27f7-eb6e-41ea-a59d-5b3ea3c09f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:05:09.000Z",
      "valid_until": "2026-06-02T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T07:32:40.342Z",
      "x_nadsec_last_seen": "2026-05-11T07:32:50.536Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-01T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.; user(top)=**",
      "id": "indicator--06275e4f-e0a4-4f60-b542-5816589cceb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.145.231.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:05:09.000Z",
      "valid_until": "2026-06-02T21:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T02:14:50.059Z",
      "x_nadsec_last_seen": "2026-05-30T16:19:20.969Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--18062449-f1f4-4dbb-9a80-b8769d34e62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.125.213.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:05:09.000Z",
      "valid_until": "2026-06-02T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T22:34:26.843Z",
      "x_nadsec_last_seen": "2026-05-27T08:59:07.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-01T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC; user(top)=**",
      "id": "indicator--d2f52842-5c21-43c2-a0c9-375760a275b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.240.44.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:05:09.000Z",
      "valid_until": "2026-06-02T21:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T20:12:51.016Z",
      "x_nadsec_last_seen": "2026-05-24T18:20:06.225Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200590"
      ],
      "x_nadsec_orgs": [
        "NLS Kazakhstan LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-01T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED",
      "id": "indicator--dafe0464-c7ce-4d58-8d55-e073a4d1a80f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.27.109.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:05:12.000Z",
      "valid_until": "2026-06-02T22:05:10.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-05-02T21:01:15.244Z",
      "x_nadsec_last_seen": "2026-05-24T18:35:46.194Z",
      "x_nadsec_ports": [
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-05-01T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--78b5a1f3-8ec0-438e-97cf-3a5c5fc14509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.88.214.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:05:12.000Z",
      "valid_until": "2026-06-02T22:05:10.000Z"
    },
    {
      "created": "2026-05-01T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:05:12.000Z",
      "valid_until": "2026-06-02T22:05:10.000Z"
    },
    {
      "created": "2026-05-01T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--57ba0d53-56f6-4129-a836-b834dcb9c80e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.153.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:05:12.000Z",
      "valid_until": "2026-06-02T22:05:10.000Z"
    },
    {
      "created": "2026-05-01T22:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=60246; asn_org=Consumer Internet Cooperative PG-19",
      "id": "indicator--51924b78-8249-49b8-b167-0020b4d2c584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T22:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.174.109.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:05:12.000Z",
      "valid_until": "2026-06-02T22:05:10.000Z"
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56290187-9991-4118-bf2c-cd42ed92c57c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T22:30:12.819Z",
      "x_nadsec_last_seen": "2026-05-24T23:38:22.444Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=20207; asn_org=Gigared S.A.",
      "id": "indicator--aed061ae-3f1f-4005-b0e6-8e9d4072e1af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.183.218.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z"
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--cace4904-a541-4d6c-81b1-095ca4bee20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.205.106.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z"
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3a99db0a-6d47-4abb-af7b-9e02259f5cdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.144.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z"
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--73235425-0299-4de6-bc98-4c2880c52735",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.156.87.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z"
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--3d98529d-bd00-43e7-af29-5f3d20d6da10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.139.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z"
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--10b950d9-c7ff-4858-9e0c-8d490e246ae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.186.98.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-02T00:49:20.799Z",
      "x_nadsec_last_seen": "2026-05-02T00:49:34.603Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--9c0ec28d-2eb1-4f19-a33f-656b4751d456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.57.187.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z"
    },
    {
      "created": "2026-05-01T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-01T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:05:09.000Z",
      "valid_until": "2026-06-02T23:05:08.000Z"
    },
    {
      "created": "2026-05-02T00:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47626; asn_org=Timer, LLC",
      "id": "indicator--356992cb-6997-48a3-8f00-86d57a1e2dba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.118.236.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:05:16.000Z",
      "valid_until": "2026-06-03T00:05:09.000Z"
    },
    {
      "created": "2026-05-02T00:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ac3de06c-8570-4fb4-9db9-5c73ad9816ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:05:16.000Z",
      "valid_until": "2026-06-03T00:05:09.000Z"
    },
    {
      "created": "2026-05-02T00:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--034e9886-ec31-460a-a214-f2107f054229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:05:16.000Z",
      "valid_until": "2026-06-03T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T00:03:43.539Z",
      "x_nadsec_last_seen": "2026-05-02T00:03:43.539Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T00:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--de41a027-9ede-4877-9c35-a4914c5cdeb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T00:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.187.123.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:05:16.000Z",
      "valid_until": "2026-06-03T00:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-16T21:32:15.297Z",
      "x_nadsec_last_seen": "2026-05-24T19:02:46.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--d0acccd8-b5d0-4bbc-98ed-1678efa35438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.11.95.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T00:14:25.421Z",
      "x_nadsec_last_seen": "2026-05-02T00:14:25.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--05b9427f-a1c1-4969-b25b-b741c16d496e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.87.161.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T00:05:12.951Z",
      "x_nadsec_last_seen": "2026-05-02T00:05:12.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8bf5a8b9-f792-4f98-b347-fc94c3ef6e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.148.5.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T00:09:17.430Z",
      "x_nadsec_last_seen": "2026-05-16T00:09:04.391Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--3ca25064-7cb4-44bc-895a-141741fc94dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.24.179.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-05-02T00:07:59.138Z",
      "x_nadsec_last_seen": "2026-05-02T00:12:54.552Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "d*****n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KZ; asn=29355; asn_org=Kcell JSC",
      "id": "indicator--e064c081-4a6a-4b2a-bfb5-92e8bf6bd138",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.73.47.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T01:00:32.423Z",
      "x_nadsec_last_seen": "2026-05-02T01:00:32.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "29355"
      ],
      "x_nadsec_orgs": [
        "Kcell JSC"
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--94cff398-ecb2-4b01-9021-204bff7ff7c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.152.118.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T00:52:49.945Z",
      "x_nadsec_last_seen": "2026-05-02T00:52:49.945Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--381ef45d-653f-4785-888d-2ef4037ff877",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T00:13:50.278Z",
      "x_nadsec_last_seen": "2026-05-02T00:13:50.278Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8595; asn_org=OOO WestCall Ltd.",
      "id": "indicator--b8aee76e-259b-4cca-aa4c-89a9336ee2db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.174.229.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:05:10.000Z",
      "valid_until": "2026-06-03T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T00:31:50.913Z",
      "x_nadsec_last_seen": "2026-05-02T00:33:57.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8595"
      ],
      "x_nadsec_orgs": [
        "OOO WestCall Ltd."
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=110; services=mysqld; ports=3306; cc=CN; asn=151185; asn_org=China Telecom",
      "id": "indicator--fa5e2fc8-49dc-49a0-ad21-a120e42f5a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.170.173.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 110,
      "x_nadsec_first_seen": "2026-05-02T01:41:44.776Z",
      "x_nadsec_last_seen": "2026-05-02T01:45:01.140Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "151185"
      ],
      "x_nadsec_orgs": [
        "China Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-02T01:44:43.885Z",
      "x_nadsec_last_seen": "2026-05-28T00:26:44.773Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=24863; asn_org=LINKdotNET; user(top)=**",
      "id": "indicator--57a8cf03-f4f9-479e-9351-9799a6a7c659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.164.196.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T01:39:56.601Z",
      "x_nadsec_last_seen": "2026-05-02T01:39:56.601Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T02:01:50.852Z",
      "x_nadsec_last_seen": "2026-05-24T00:59:24.500Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--decda0bc-85e1-44dc-9342-fb5c7ebfeca8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.118.32.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T01:29:58.897Z",
      "x_nadsec_last_seen": "2026-05-26T19:18:18.871Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1af669c8-e4d7-4ff3-bf6e-d6b54b556f65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.14.74.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T01:39:21.732Z",
      "x_nadsec_last_seen": "2026-05-02T01:39:21.732Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bd8fc033-ab41-4f62-88c9-ff7cde0c2b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.65.106.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 3146,
      "x_nadsec_first_seen": "2026-05-02T02:03:23.711Z",
      "x_nadsec_last_seen": "2026-05-02T03:03:06.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T01:51:00.114Z",
      "x_nadsec_last_seen": "2026-05-02T01:51:10.439Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b0f66a9d-5cc3-4242-9ab9-b59ef65b1de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T01:35:56.323Z",
      "x_nadsec_last_seen": "2026-05-02T01:35:56.323Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--22a7f4a5-5831-4a45-8aed-7197ea5d78dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-02T01:23:35.120Z",
      "x_nadsec_last_seen": "2026-05-03T05:45:36.135Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9142746a-80e6-4e5e-a5e9-4bb8469488c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:05:10.000Z",
      "valid_until": "2026-06-03T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T01:34:04.896Z",
      "x_nadsec_last_seen": "2026-05-14T01:07:44.294Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--78db4083-d425-4963-ab2e-5167a40cda22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.182.195.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-02T02:29:27.240Z",
      "x_nadsec_last_seen": "2026-05-22T03:51:13.364Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--7e0130ef-95b5-4489-b474-0e40af3035cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.211.74.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-02T02:52:12.767Z",
      "x_nadsec_last_seen": "2026-05-23T04:40:16.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--ec598d0c-6f00-4866-b3d4-e690f15724fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.75.205.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T02:46:51.627Z",
      "x_nadsec_last_seen": "2026-05-02T02:46:51.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=262974; asn_org=leal porto; user(top)=**",
      "id": "indicator--80104620-c6cb-4c52-85ec-29d057048557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.250.158.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T03:01:48.662Z",
      "x_nadsec_last_seen": "2026-05-02T03:01:48.662Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262974"
      ],
      "x_nadsec_orgs": [
        "leal porto"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--36b308a4-54c3-4052-9acb-6c310d94998a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.235.32.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-02T02:52:14.927Z",
      "x_nadsec_last_seen": "2026-05-02T02:52:37.390Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "0******8"
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=5033; asn_org=Key Information Systems, Inc.",
      "id": "indicator--3f106623-0656-4fb8-b28f-b792ce457f7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '207.178.209.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T02:22:18.475Z",
      "x_nadsec_last_seen": "2026-05-05T11:41:54.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5033"
      ],
      "x_nadsec_orgs": [
        "Key Information Systems, Inc."
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T02:33:36.913Z",
      "x_nadsec_last_seen": "2026-05-02T02:33:38.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T03:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--bd36a082-d531-4406-97aa-27fe45f6bb79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T03:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.237.232.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:05:19.000Z",
      "valid_until": "2026-06-03T03:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T02:34:01.836Z",
      "x_nadsec_last_seen": "2026-05-14T20:58:59.956Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CA; asn=16276; asn_org=OVH SAS",
      "id": "indicator--6f214f42-137e-4ba8-9787-bf8fe2b8e7de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '15.235.5.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T03:15:28.332Z",
      "x_nadsec_last_seen": "2026-05-16T11:49:06.989Z",
      "x_nadsec_ports": [
        "1433",
        "445"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=5429; asn_org=Telecommunications center UMOS, LLC",
      "id": "indicator--2447ff83-3040-4184-a942-b50bbbc81acc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.178.197.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-02T03:43:42.855Z",
      "x_nadsec_last_seen": "2026-05-24T09:45:58.298Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "5429"
      ],
      "x_nadsec_orgs": [
        "Telecommunications center UMOS, LLC"
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5a7b9fce-c8ff-42fb-b269-9f553e94c370",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T03:55:46.939Z",
      "x_nadsec_last_seen": "2026-05-02T03:55:46.939Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--55247113-2db0-4fbe-a0ce-fe12fca9ac6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T03:52:02.998Z",
      "x_nadsec_last_seen": "2026-05-02T03:52:02.998Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--73d42459-85d3-4200-8d1f-1b1753cb5d69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T03:48:51.896Z",
      "x_nadsec_last_seen": "2026-05-19T18:49:33.897Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.151.241.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-05-02T03:50:52.228Z",
      "x_nadsec_last_seen": "2026-05-20T19:06:54.518Z",
      "x_nadsec_ports": [
        "1723",
        "3306",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mysqld",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8dad4109-4a58-4fd8-b61c-b863b34d0373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T03:13:05.144Z",
      "x_nadsec_last_seen": "2026-05-03T00:08:55.477Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T03:33:57.992Z",
      "x_nadsec_last_seen": "2026-05-25T16:38:41.337Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2edb8226-bfe7-4e23-ab19-c237020ba2c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:05:10.000Z",
      "valid_until": "2026-06-03T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T03:34:25.320Z",
      "x_nadsec_last_seen": "2026-05-07T15:21:58.746Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--dab4783e-8bc7-4246-98bd-ed590ee21bdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.250.33.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-02T04:06:31.998Z",
      "x_nadsec_last_seen": "2026-05-02T04:37:06.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--64947df5-cb32-4e13-a069-8991e9486466",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T04:28:25.468Z",
      "x_nadsec_last_seen": "2026-05-17T18:33:15.992Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6c7dcf48-eb5b-4c3f-be52-4b8eeaf4015c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T04:21:08.684Z",
      "x_nadsec_last_seen": "2026-05-02T04:21:08.684Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--32198403-abc6-43ed-8ddd-eb62d9f43890",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T04:37:47.393Z",
      "x_nadsec_last_seen": "2026-05-24T19:47:55.486Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "ftpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--7ba0dadb-bdb9-4e38-a2f0-baead280c9f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.234.253.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T04:31:14.354Z",
      "x_nadsec_last_seen": "2026-05-02T04:38:28.743Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--3fa9b898-29d9-4925-8a81-545e08be67c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.44.91.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T04:57:24.973Z",
      "x_nadsec_last_seen": "2026-05-02T04:57:24.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--3e7f98a3-344e-489b-b032-223c0a886b3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T04:49:13.669Z",
      "x_nadsec_last_seen": "2026-05-02T04:49:13.669Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35298; asn_org=PJSC MegaFon",
      "id": "indicator--86a042b3-9f81-424a-8a58-b06e9a88eb6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.41.103.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:05:10.000Z",
      "valid_until": "2026-06-03T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T04:09:46.822Z",
      "x_nadsec_last_seen": "2026-05-02T04:11:53.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35298"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-02T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--badbe13b-2b4c-4a18-9281-0f1ff9086c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.159.99.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:05:09.000Z",
      "valid_until": "2026-06-03T06:05:08.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-05-02T05:51:52.474Z",
      "x_nadsec_last_seen": "2026-05-02T21:00:06.541Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-05-02T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--59829283-0de4-46b4-92d7-f834e531dd06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:05:09.000Z",
      "valid_until": "2026-06-03T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T05:44:23.095Z",
      "x_nadsec_last_seen": "2026-05-17T10:24:30.052Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc; user(top)=**",
      "id": "indicator--15ab9d55-b750-40ce-a43d-4eb19a05cfaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.165.93.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:05:09.000Z",
      "valid_until": "2026-06-03T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T05:51:10.176Z",
      "x_nadsec_last_seen": "2026-05-02T05:51:10.176Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=AR; asn=266702; asn_org=MEGALINK S.R.L.",
      "id": "indicator--ac28825a-1b77-41e1-92c0-77c60a2a3129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.230.66.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:05:09.000Z",
      "valid_until": "2026-06-03T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T05:22:34.282Z",
      "x_nadsec_last_seen": "2026-05-02T05:22:34.282Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "266702"
      ],
      "x_nadsec_orgs": [
        "MEGALINK S.R.L."
      ]
    },
    {
      "created": "2026-05-02T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:05:09.000Z",
      "valid_until": "2026-06-03T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T05:28:22.805Z",
      "x_nadsec_last_seen": "2026-05-02T05:28:22.805Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d4f5bf8d-97f6-4087-9dc2-8671918706af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T06:49:55.423Z",
      "x_nadsec_last_seen": "2026-05-02T06:49:55.423Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8c2f98c3-7080-41cb-8fc4-3f6002181d03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T06:53:52.996Z",
      "x_nadsec_last_seen": "2026-05-02T06:53:53.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b3543ef0-060a-4ffc-bf80-d23018658e71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.196.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T06:55:54.826Z",
      "x_nadsec_last_seen": "2026-05-02T06:56:38.268Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--07e8f896-119d-4895-bdd9-bdfed3fbc757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.2.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T06:54:02.796Z",
      "x_nadsec_last_seen": "2026-05-02T06:54:02.796Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--666e3e33-ed3b-45d8-9d41-f69f594bd9bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.114.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T06:06:00.253Z",
      "x_nadsec_last_seen": "2026-05-02T06:06:00.253Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T06:32:35.819Z",
      "x_nadsec_last_seen": "2026-05-21T08:02:02.545Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mqttd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--bd8bfaf3-cf8f-41eb-b898-09427d4a1922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T06:08:04.320Z",
      "x_nadsec_last_seen": "2026-05-20T04:06:46.430Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c2c267df-435f-41ae-97cf-2d50e56766d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:05:09.000Z",
      "valid_until": "2026-06-03T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T06:23:39.058Z",
      "x_nadsec_last_seen": "2026-05-15T00:35:36.293Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4ce44850-fe1e-48c6-8334-9a0c45fc7df1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:05:09.000Z",
      "valid_until": "2026-06-03T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T07:28:56.469Z",
      "x_nadsec_last_seen": "2026-05-02T07:28:56.469Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--4876dc11-adf1-47bc-8252-b1d18f9fe023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:05:09.000Z",
      "valid_until": "2026-06-03T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T07:55:31.510Z",
      "x_nadsec_last_seen": "2026-05-02T07:55:31.510Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-02T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC; user(top)=**",
      "id": "indicator--b3adbf8a-a893-4027-929e-6698b8e9ea3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.54.96.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:05:09.000Z",
      "valid_until": "2026-06-03T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T07:54:43.212Z",
      "x_nadsec_last_seen": "2026-05-02T07:54:43.212Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.216.254.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:05:09.000Z",
      "valid_until": "2026-06-03T08:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-02T07:26:29.751Z",
      "x_nadsec_last_seen": "2026-05-27T06:25:14.399Z",
      "x_nadsec_ports": [
        "21",
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=214664; asn_org=JSC Buduschee",
      "id": "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:05:09.000Z",
      "valid_until": "2026-06-03T08:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-02T07:23:35.686Z",
      "x_nadsec_last_seen": "2026-05-28T19:45:31.203Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "214664"
      ],
      "x_nadsec_orgs": [
        "JSC Buduschee"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-05-02T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.241.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:05:09.000Z",
      "valid_until": "2026-06-03T08:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-02T07:39:58.831Z",
      "x_nadsec_last_seen": "2026-05-02T07:44:34.375Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "42427"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-02T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--8b41574f-b1f4-4958-9110-d73a2399cbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.14.33.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:05:09.000Z",
      "valid_until": "2026-06-03T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T08:19:45.174Z",
      "x_nadsec_last_seen": "2026-05-30T16:35:23.097Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--be4f1d22-4742-4b33-a1b1-be71cac258e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.52.173.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:05:09.000Z",
      "valid_until": "2026-06-03T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T08:19:44.532Z",
      "x_nadsec_last_seen": "2026-05-12T09:52:37.611Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-02T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:05:09.000Z",
      "valid_until": "2026-06-03T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T08:19:20.718Z",
      "x_nadsec_last_seen": "2026-05-25T12:51:37.457Z",
      "x_nadsec_ports": [
        "27017",
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--297a2296-fa4e-4d40-b598-d46179a38aa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.244.250.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T09:31:24.137Z",
      "x_nadsec_last_seen": "2026-05-02T09:38:25.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.133.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-02T09:11:00.111Z",
      "x_nadsec_last_seen": "2026-05-02T09:11:32.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--39d6455f-1bb6-4ec1-89ed-cf5872467e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.220.3.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T09:32:49.399Z",
      "x_nadsec_last_seen": "2026-05-02T09:34:56.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JP; asn=4713; asn_org=NTT DOCOMO BUSINESS,Inc.",
      "id": "indicator--7428ce10-2b70-4545-97eb-841054ac9691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.225.99.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T09:28:02.909Z",
      "x_nadsec_last_seen": "2026-05-02T09:28:08.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "4713"
      ],
      "x_nadsec_orgs": [
        "NTT DOCOMO BUSINESS,Inc."
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=25227; asn_org=JSC Avantel; user(top)=**",
      "id": "indicator--de62ae97-9e90-4f8f-b5b9-c79ef748a826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.24.45.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T09:40:33.617Z",
      "x_nadsec_last_seen": "2026-05-02T09:40:33.617Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25227"
      ],
      "x_nadsec_orgs": [
        "JSC Avantel"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--c70e2ff9-954c-414e-abc7-16cb0add4ca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.141.204.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T09:54:38.943Z",
      "x_nadsec_last_seen": "2026-05-02T10:00:14.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--49fb972e-6544-401e-a93c-25a61e84bc5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T09:42:37.036Z",
      "x_nadsec_last_seen": "2026-05-02T09:42:37.528Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=29124; asn_org=Iskratelecom JSC",
      "id": "indicator--fbbfc894-d507-4aba-a880-3ff6d0bd5f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.200.3.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T09:49:33.213Z",
      "x_nadsec_last_seen": "2026-05-02T09:49:33.917Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29124"
      ],
      "x_nadsec_orgs": [
        "Iskratelecom JSC"
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=DE; asn=8560; asn_org=IONOS SE",
      "id": "indicator--0d9be2fd-a8d1-45e3-b2e4-1399bf7ad788",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.215.181.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T09:19:25.797Z",
      "x_nadsec_last_seen": "2026-05-02T09:19:25.797Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "8560"
      ],
      "x_nadsec_orgs": [
        "IONOS SE"
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=62150; asn_org=BARS Group JSC",
      "id": "indicator--0ce27120-4b94-4439-9069-466a94168c7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.170.52.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T09:07:11.474Z",
      "x_nadsec_last_seen": "2026-05-02T09:09:18.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "62150"
      ],
      "x_nadsec_orgs": [
        "BARS Group JSC"
      ]
    },
    {
      "created": "2026-05-02T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T10:05:04.000Z",
      "valid_until": "2026-06-03T10:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T09:54:06.516Z",
      "x_nadsec_last_seen": "2026-05-18T06:56:42.090Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-02T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=smbd; ports=445; cc=ID; asn=63494; asn_org=PT Inovasi Jaringan Nusantara",
      "id": "indicator--19c8d877-6566-49bd-a601-d2becb333abf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.37.168.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:05:09.000Z",
      "valid_until": "2026-06-03T11:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-02T10:42:43.914Z",
      "x_nadsec_last_seen": "2026-05-02T10:43:24.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63494"
      ],
      "x_nadsec_orgs": [
        "PT Inovasi Jaringan Nusantara"
      ]
    },
    {
      "created": "2026-05-02T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--0e00f9da-ae75-4869-8c52-eff9e6416a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.224.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:05:09.000Z",
      "valid_until": "2026-06-03T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T10:52:27.409Z",
      "x_nadsec_last_seen": "2026-05-31T22:21:56.580Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-02T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--49cf923f-6047-4c01-a355-0e75764e7a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.157.38.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:05:09.000Z",
      "valid_until": "2026-06-03T11:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-02T10:20:24.263Z",
      "x_nadsec_last_seen": "2026-05-09T18:31:42.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-02T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--64541b80-ff2f-40de-bab3-8ab9defdcd30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:05:09.000Z",
      "valid_until": "2026-06-03T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T10:22:09.416Z",
      "x_nadsec_last_seen": "2026-05-02T10:22:09.416Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-02T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.74.38.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:05:05.000Z",
      "valid_until": "2026-06-03T12:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T11:16:17.998Z",
      "x_nadsec_last_seen": "2026-05-02T11:16:17.998Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-02T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=262186; asn_org=TV AZTECA SUCURSAL COLOMBIA",
      "id": "indicator--eb7db47b-7370-438e-ad08-63519f8c931b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.148.183.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:05:05.000Z",
      "valid_until": "2026-06-03T12:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T11:05:26.472Z",
      "x_nadsec_last_seen": "2026-05-02T11:06:33.964Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "262186"
      ],
      "x_nadsec_orgs": [
        "TV AZTECA SUCURSAL COLOMBIA"
      ]
    },
    {
      "created": "2026-05-02T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--72cef475-3686-44ad-a870-d1e60c5b097c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.19.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:05:05.000Z",
      "valid_until": "2026-06-03T12:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T11:12:29.176Z",
      "x_nadsec_last_seen": "2026-05-29T09:07:52.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-02T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3c0ad1e1-c98a-4b43-94b8-e0760a00f047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.144.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:05:05.000Z",
      "valid_until": "2026-06-03T12:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T11:24:34.538Z",
      "x_nadsec_last_seen": "2026-05-02T11:24:34.538Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--63f189ef-baa8-4602-8db1-93bf187a0193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:05:05.000Z",
      "valid_until": "2026-06-03T12:05:04.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-02T11:12:53.859Z",
      "x_nadsec_last_seen": "2026-05-25T12:51:31.057Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1433",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-02T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--60b7d436-d4cb-4634-a555-39729a921e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.135.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:05:05.000Z",
      "valid_until": "2026-06-03T12:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T11:35:12.012Z",
      "x_nadsec_last_seen": "2026-05-20T15:27:44.395Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--094f4f4d-4803-4326-b990-30effe7b8c38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.156.118.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:05:05.000Z",
      "valid_until": "2026-06-03T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T12:17:59.575Z",
      "x_nadsec_last_seen": "2026-05-02T12:17:59.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--52e4d1c6-f52a-483b-9ae9-813c14add87c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:05:05.000Z",
      "valid_until": "2026-06-03T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T12:18:49.424Z",
      "x_nadsec_last_seen": "2026-05-02T12:18:49.424Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--95922197-b292-4928-aed2-9c2e3b495108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.88.16.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:05:05.000Z",
      "valid_until": "2026-06-03T13:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T12:13:45.098Z",
      "x_nadsec_last_seen": "2026-05-02T12:13:45.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:05:05.000Z",
      "valid_until": "2026-06-03T13:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T12:59:23.125Z",
      "x_nadsec_last_seen": "2026-05-29T15:19:18.023Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-02T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T13:05:05.000Z",
      "valid_until": "2026-06-03T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T12:23:10.700Z",
      "x_nadsec_last_seen": "2026-05-30T00:38:01.947Z",
      "x_nadsec_ports": [
        "3306",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--6cdef90f-9f8b-48f9-8b44-70b9d82bc2cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.250.172.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T13:39:14.167Z",
      "x_nadsec_last_seen": "2026-05-02T13:39:14.167Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=PE; asn=22411; asn_org=GTD PERU S.A",
      "id": "indicator--37fbc6aa-a135-493e-99e0-cd54fdd5b756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.132.157.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-02T13:29:54.915Z",
      "x_nadsec_last_seen": "2026-05-31T18:25:02.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "22411"
      ],
      "x_nadsec_orgs": [
        "GTD PERU S.A"
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--25f29ee3-8697-4b93-9f49-bcbc3a6ae55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.150.75.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T13:17:23.041Z",
      "x_nadsec_last_seen": "2026-05-02T13:17:23.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T13:54:56.184Z",
      "x_nadsec_last_seen": "2026-05-27T13:40:53.584Z",
      "x_nadsec_ports": [
        "21",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T13:32:40.723Z",
      "x_nadsec_last_seen": "2026-05-19T00:14:28.239Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T13:32:48.825Z",
      "x_nadsec_last_seen": "2026-05-25T15:01:01.270Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--2d507a7c-c4f5-4704-9146-136fdde336cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.189.141.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T13:26:51.261Z",
      "x_nadsec_last_seen": "2026-05-02T13:28:57.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-02T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8345; asn_org=JSC ER-Telecom Holding",
      "id": "indicator--b4b382fe-824b-474c-9f26-c9ce90ab5a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.185.53.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:05:10.000Z",
      "valid_until": "2026-06-03T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T13:07:54.893Z",
      "x_nadsec_last_seen": "2026-05-02T13:10:03.035Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8345"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ]
    },
    {
      "created": "2026-05-02T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=JP; asn=2527; asn_org=Sony Network Communications Inc.; user(top)=**",
      "id": "indicator--355cf287-6455-4afa-8792-3df2ae75f27b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.28.70.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:05:16.000Z",
      "valid_until": "2026-06-03T15:05:15.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T14:19:04.132Z",
      "x_nadsec_last_seen": "2026-05-02T14:19:04.606Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2527"
      ],
      "x_nadsec_orgs": [
        "Sony Network Communications Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--701d887f-32a6-411b-9219-490814d36735",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:05:16.000Z",
      "valid_until": "2026-06-03T15:05:15.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T14:38:33.425Z",
      "x_nadsec_last_seen": "2026-05-28T20:17:12.125Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--a8c9321f-7eac-4fb8-9f97-fe3d52d04f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:05:16.000Z",
      "valid_until": "2026-06-03T15:05:15.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T15:01:37.230Z",
      "x_nadsec_last_seen": "2026-05-29T13:46:04.966Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB",
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d213b242-ffcb-4fab-b173-67a2a7d6e712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:05:16.000Z",
      "valid_until": "2026-06-03T15:05:15.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T14:26:47.370Z",
      "x_nadsec_last_seen": "2026-05-02T14:26:47.370Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T15:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T15:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T15:05:16.000Z",
      "valid_until": "2026-06-03T15:05:15.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T14:57:32.292Z",
      "x_nadsec_last_seen": "2026-05-25T13:39:39.194Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-02T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--2a168b7d-12f7-41d2-b3f2-f174c6c883a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.96.88.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:05:04.000Z",
      "valid_until": "2026-06-03T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T15:23:53.721Z",
      "x_nadsec_last_seen": "2026-05-02T15:25:58.624Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-05-02T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:05:04.000Z",
      "valid_until": "2026-06-03T16:05:03.000Z",
      "x_nadsec_event_count": 71,
      "x_nadsec_first_seen": "2026-05-02T15:15:11.411Z",
      "x_nadsec_last_seen": "2026-05-24T03:14:31.235Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "27017",
        "1723",
        "3306",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mongod",
        "pptpd",
        "mysqld",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-02T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e60512a9-cbc4-4043-ba51-3e0bab64de5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:05:04.000Z",
      "valid_until": "2026-06-03T16:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T15:57:39.762Z",
      "x_nadsec_last_seen": "2026-05-29T23:08:47.655Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--ba238b03-63ab-4310-a5c4-58ee97d5313a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.243.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:05:04.000Z",
      "valid_until": "2026-06-03T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T15:06:08.735Z",
      "x_nadsec_last_seen": "2026-05-02T15:06:08.735Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-02T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--50b798b1-1619-4cec-a221-a0c70a270814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T16:05:04.000Z",
      "valid_until": "2026-06-03T16:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-02T15:51:50.862Z",
      "x_nadsec_last_seen": "2026-05-18T04:15:19.981Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-02T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=4788; asn_org=TM TECHNOLOGY SERVICES SDN. BHD.",
      "id": "indicator--042ae63a-bcb1-4e7b-916a-e25a5581e02f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.9.164.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:05:10.000Z",
      "valid_until": "2026-06-03T17:05:09.000Z",
      "x_nadsec_event_count": 33,
      "x_nadsec_first_seen": "2026-05-02T16:26:30.599Z",
      "x_nadsec_last_seen": "2026-05-30T09:17:56.328Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4788"
      ],
      "x_nadsec_orgs": [
        "TM TECHNOLOGY SERVICES SDN. BHD."
      ]
    },
    {
      "created": "2026-05-02T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--79813d75-6c7a-464e-a718-91dbd349c49c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.91.93.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:05:10.000Z",
      "valid_until": "2026-06-03T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T16:42:12.500Z",
      "x_nadsec_last_seen": "2026-05-02T16:42:20.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-02T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=12091; asn_org=MTNNS-1",
      "id": "indicator--918f9f70-2735-4d8b-9ad6-d5bdd9694b61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.64.133.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:05:10.000Z",
      "valid_until": "2026-06-03T17:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-02T17:04:53.360Z",
      "x_nadsec_last_seen": "2026-05-02T17:07:58.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "12091"
      ],
      "x_nadsec_orgs": [
        "MTNNS-1"
      ]
    },
    {
      "created": "2026-05-02T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--89706f3c-0e83-4b11-9b80-8372c3cd853f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.187.118.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:05:10.000Z",
      "valid_until": "2026-06-03T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T16:52:02.081Z",
      "x_nadsec_last_seen": "2026-05-02T16:59:27.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-02T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=12479; asn_org=Orange Espagne SA",
      "id": "indicator--853da764-4e23-43d3-be4b-5b9aa1676119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.189.225.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T17:05:10.000Z",
      "valid_until": "2026-06-03T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T16:58:10.727Z",
      "x_nadsec_last_seen": "2026-05-02T17:00:16.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12479"
      ],
      "x_nadsec_orgs": [
        "Orange Espagne SA"
      ]
    },
    {
      "created": "2026-05-02T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134929; asn_org=ORANGE CITY INTERNET SERVICES PVT. LTD.",
      "id": "indicator--2f6b27d2-c93e-4f4e-940d-bbed15c9d9f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.1.119.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:05:10.000Z",
      "valid_until": "2026-06-03T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T17:46:40.549Z",
      "x_nadsec_last_seen": "2026-05-02T17:48:45.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134929"
      ],
      "x_nadsec_orgs": [
        "ORANGE CITY INTERNET SERVICES PVT. LTD."
      ]
    },
    {
      "created": "2026-05-02T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UG; asn=20294; asn_org=MTN",
      "id": "indicator--ead5317a-074d-44bb-bfe4-b640fbcf5fd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.88.123.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:05:10.000Z",
      "valid_until": "2026-06-03T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T17:08:28.631Z",
      "x_nadsec_last_seen": "2026-05-02T17:10:36.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UG"
      ],
      "x_nadsec_asns": [
        "20294"
      ],
      "x_nadsec_orgs": [
        "MTN"
      ]
    },
    {
      "created": "2026-05-02T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:05:10.000Z",
      "valid_until": "2026-06-03T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T17:29:52.198Z",
      "x_nadsec_last_seen": "2026-05-02T17:30:02.722Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-05-02T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--155b0016-3972-48db-9719-5d5a7ae3df20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:05:10.000Z",
      "valid_until": "2026-06-03T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T17:30:17.157Z",
      "x_nadsec_last_seen": "2026-05-27T21:05:46.493Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-02T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--07879074-155b-448f-8625-3bc048cf69e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:05:10.000Z",
      "valid_until": "2026-06-03T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T17:30:16.487Z",
      "x_nadsec_last_seen": "2026-05-22T18:17:52.245Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-02T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:05:10.000Z",
      "valid_until": "2026-06-03T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T17:29:51.248Z",
      "x_nadsec_last_seen": "2026-05-02T17:29:51.248Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-02T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T18:05:10.000Z",
      "valid_until": "2026-06-03T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T17:29:51.637Z",
      "x_nadsec_last_seen": "2026-05-02T17:29:51.637Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-02T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--eed0c34d-7f76-4474-8cc2-a605dcff0c9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.62.172.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:05:09.000Z",
      "valid_until": "2026-06-03T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T18:45:13.610Z",
      "x_nadsec_last_seen": "2026-05-02T18:45:13.610Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--151d1eac-db38-41f9-8337-881f13445b51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.239.51.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:05:09.000Z",
      "valid_until": "2026-06-03T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T18:54:19.575Z",
      "x_nadsec_last_seen": "2026-05-02T18:56:25.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-02T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9525cd3f-a376-4380-988d-afaf37bfeceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:05:09.000Z",
      "valid_until": "2026-06-03T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T18:05:33.923Z",
      "x_nadsec_last_seen": "2026-05-16T20:30:49.792Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-02T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--17ba85fb-4b09-4518-b3fd-0cd7407a6fc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.126.233.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T19:05:09.000Z",
      "valid_until": "2026-06-03T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T18:58:00.301Z",
      "x_nadsec_last_seen": "2026-05-02T19:05:55.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-02T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d9ccea05-d338-4ce4-9c91-84dc48f9011c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.98.204.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:05:10.000Z",
      "valid_until": "2026-06-03T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T20:01:36.038Z",
      "x_nadsec_last_seen": "2026-05-02T20:04:01.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-02T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB; user(top)=**",
      "id": "indicator--4cf1ddf3-d0a9-46a4-8b51-9f6bbc3a9320",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.146.242.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:05:10.000Z",
      "valid_until": "2026-06-03T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T19:56:57.605Z",
      "x_nadsec_last_seen": "2026-05-02T19:56:57.605Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-02T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.252.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T20:05:10.000Z",
      "valid_until": "2026-06-03T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T19:29:19.646Z",
      "x_nadsec_last_seen": "2026-05-02T19:29:19.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=135905; asn_org=VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "id": "indicator--b78655a1-a46e-4938-bf52-4a41b384fe78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.200.23.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T20:29:15.363Z",
      "x_nadsec_last_seen": "2026-05-02T20:29:15.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135905"
      ],
      "x_nadsec_orgs": [
        "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--e862f2b5-07ae-4f69-baa8-14e79cad5241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.109.46.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T20:58:34.278Z",
      "x_nadsec_last_seen": "2026-05-02T20:58:34.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--12d6b640-172b-4bbb-9073-567b36269d11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.198.131.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-02T21:01:44.185Z",
      "x_nadsec_last_seen": "2026-05-02T21:01:52.393Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2a01da51-d2ff-4704-8cd8-b8820cbeb9fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T20:37:36.309Z",
      "x_nadsec_last_seen": "2026-05-08T19:31:59.385Z",
      "x_nadsec_ports": [
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--c7fe54cb-4a8c-43d9-9893-3643e7fa0d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T20:22:39.044Z",
      "x_nadsec_last_seen": "2026-05-02T20:22:39.044Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--7af1846e-fb02-433e-96dc-42b5407d4731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.115.206.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T20:07:14.446Z",
      "x_nadsec_last_seen": "2026-05-02T20:07:15.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8570; asn_org=Rostelecom",
      "id": "indicator--e5afe223-b2ff-4cb3-97f4-2929960c4358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.34.242.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T20:19:30.896Z",
      "x_nadsec_last_seen": "2026-05-02T20:21:37.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8570"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5963635c-4ff2-4604-a6d5-2526ce7751a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.219.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-02T20:37:42.152Z",
      "x_nadsec_last_seen": "2026-05-27T12:16:40.698Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T21:05:10.000Z",
      "valid_until": "2026-06-03T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T20:50:21.929Z",
      "x_nadsec_last_seen": "2026-05-18T01:38:24.244Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--7d5447f7-5a25-4aed-9b7a-a524535b9de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T21:08:54.763Z",
      "x_nadsec_last_seen": "2026-05-24T09:59:17.601Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--912abaa9-0481-4484-aed1-b8e50d097aa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.198.131.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-02T21:18:39.819Z",
      "x_nadsec_last_seen": "2026-05-02T21:18:45.868Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--bee5baef-fe7c-4993-bb9e-e17310273f17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T21:43:40.446Z",
      "x_nadsec_last_seen": "2026-05-05T03:48:08.886Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=11776; asn_org=Breezeline",
      "id": "indicator--0cfaf03a-d2c0-49f7-a3fc-b44bb7cfc777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.188.140.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T21:50:07.698Z",
      "x_nadsec_last_seen": "2026-05-02T21:50:07.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11776"
      ],
      "x_nadsec_orgs": [
        "Breezeline"
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e08be4cb-11b5-42cb-bdda-d3fbb9541e8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.105.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T21:41:58.504Z",
      "x_nadsec_last_seen": "2026-05-09T13:53:02.289Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--5221a78d-faca-49f8-889c-84bf32b8eda4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.45.253.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-02T21:36:29.238Z",
      "x_nadsec_last_seen": "2026-05-28T12:18:12.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--b6b98985-0ebe-4889-ae2a-2de2f8eb7399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.125.237.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-02T21:36:28.912Z",
      "x_nadsec_last_seen": "2026-05-28T12:20:17.339Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=61452; asn_org=Restel S.A.",
      "id": "indicator--3e61c340-7c8f-4c20-a9a5-087df5c37c62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.12.33.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T21:38:33.852Z",
      "x_nadsec_last_seen": "2026-05-28T12:20:19.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "61452"
      ],
      "x_nadsec_orgs": [
        "Restel S.A."
      ]
    },
    {
      "created": "2026-05-02T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cd2e30c8-1ce8-45e9-b3fa-352788ec1bf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:05:11.000Z",
      "valid_until": "2026-06-03T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T21:16:53.493Z",
      "x_nadsec_last_seen": "2026-05-02T21:17:03.635Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=136180; asn_org=Beijing Tiantexin Tech. Co., Ltd.",
      "id": "indicator--fb763fbb-1e0a-42d0-9ca7-982cd2e23a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:05:09.000Z",
      "valid_until": "2026-06-03T23:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-02T22:48:01.157Z",
      "x_nadsec_last_seen": "2026-05-30T05:45:59.760Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136180"
      ],
      "x_nadsec_orgs": [
        "Beijing Tiantexin Tech. Co., Ltd."
      ]
    },
    {
      "created": "2026-05-02T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--537e4fff-6613-46f4-99d3-ef3d15f1783d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:05:09.000Z",
      "valid_until": "2026-06-03T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T22:09:45.380Z",
      "x_nadsec_last_seen": "2026-05-02T23:16:40.310Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-02T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--12bd98b8-cd71-4816-958d-cd3269eac782",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.11.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:05:09.000Z",
      "valid_until": "2026-06-03T23:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-02T22:20:36.549Z",
      "x_nadsec_last_seen": "2026-05-02T22:21:32.072Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-02T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a2aa03f8-008f-44aa-8f0e-156d02c232ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:05:09.000Z",
      "valid_until": "2026-06-03T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T22:33:11.665Z",
      "x_nadsec_last_seen": "2026-05-02T22:33:11.665Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-02T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CA; asn=852; asn_org=TELUS Communications",
      "id": "indicator--106d80af-c243-466d-9365-9578f2fce67c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.250.39.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:05:09.000Z",
      "valid_until": "2026-06-03T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T22:09:36.191Z",
      "x_nadsec_last_seen": "2026-05-21T07:13:18.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "852"
      ],
      "x_nadsec_orgs": [
        "TELUS Communications"
      ]
    },
    {
      "created": "2026-05-02T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--0aa8bbb4-23c8-4a2c-bb70-229b0a580f18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.76.59.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:05:09.000Z",
      "valid_until": "2026-06-03T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T22:15:03.073Z",
      "x_nadsec_last_seen": "2026-05-02T22:15:03.582Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-02T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ES; asn=49493; asn_org=Gigas Hosting S.A.",
      "id": "indicator--efdb6241-178b-4976-9c83-aac08737951b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-02T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.26.165.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:05:09.000Z",
      "valid_until": "2026-06-03T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T23:02:06.107Z",
      "x_nadsec_last_seen": "2026-05-02T23:02:06.107Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "49493"
      ],
      "x_nadsec_orgs": [
        "Gigas Hosting S.A."
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=149907; asn_org=PT Linkbit Inovasi Teknologi",
      "id": "indicator--ed6dbdc5-97b0-48f9-bd92-8458649cf366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.190.112.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-02T23:16:04.322Z",
      "x_nadsec_last_seen": "2026-05-02T23:18:12.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "149907"
      ],
      "x_nadsec_orgs": [
        "PT Linkbit Inovasi Teknologi"
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--736f6315-a26c-47f5-aac3-89690d9edf97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.198.131.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-02T23:08:42.795Z",
      "x_nadsec_last_seen": "2026-05-02T23:08:45.665Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "210558"
      ],
      "x_nadsec_orgs": [
        "1337 Services GmbH"
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T23:50:51.049Z",
      "x_nadsec_last_seen": "2026-05-03T08:59:50.112Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=PA; asn=52284; asn_org=Panamaserver.com",
      "id": "indicator--a705193d-ccc2-4c51-93b1-3603aded4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.123.46.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-02T23:45:36.546Z",
      "x_nadsec_last_seen": "2026-05-10T21:45:03.401Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "52284"
      ],
      "x_nadsec_orgs": [
        "Panamaserver.com"
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VE; asn=22726; asn_org=C.A. Vencemos",
      "id": "indicator--347b0eff-c7a2-4c63-b5fe-c41419a82add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.35.2.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-02T23:27:58.894Z",
      "x_nadsec_last_seen": "2026-05-02T23:28:02.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "22726"
      ],
      "x_nadsec_orgs": [
        "C.A. Vencemos"
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4d89fed2-e906-41d3-8b32-70e111821041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-02T23:35:24.263Z",
      "x_nadsec_last_seen": "2026-05-23T21:07:24.288Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=TW; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--2768cece-d4d5-4256-af66-e2797141e538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-02T23:11:49.130Z",
      "x_nadsec_last_seen": "2026-05-31T14:23:19.662Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-05-03T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--6bae3587-2e1f-4ae2-8395-0075bbf9558a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T00:05:09.000Z",
      "valid_until": "2026-06-04T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-02T23:48:13.633Z",
      "x_nadsec_last_seen": "2026-05-02T23:48:13.633Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--bb6ab765-c241-43da-a27d-c26a40958c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.11.193.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:05:12.000Z",
      "valid_until": "2026-06-04T01:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-03T00:46:28.919Z",
      "x_nadsec_last_seen": "2026-05-22T08:02:43.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--9521bcfd-5bdb-43d5-bc15-d5e78c0908c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.211.74.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:05:12.000Z",
      "valid_until": "2026-06-04T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T00:44:44.760Z",
      "x_nadsec_last_seen": "2026-05-03T00:46:49.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8636d4d6-b3ab-4f48-ac9f-3bd5c1008bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.144.75.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:05:12.000Z",
      "valid_until": "2026-06-04T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T00:35:52.388Z",
      "x_nadsec_last_seen": "2026-05-03T00:35:52.388Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--07d863f7-b541-4cd8-a779-5f095da89d9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:05:12.000Z",
      "valid_until": "2026-06-04T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T00:24:06.044Z",
      "x_nadsec_last_seen": "2026-05-21T20:22:40.195Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--bb958c44-f2cc-4172-95ba-490f8892d536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.238.176.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:05:12.000Z",
      "valid_until": "2026-06-04T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T00:56:18.310Z",
      "x_nadsec_last_seen": "2026-05-03T00:56:18.310Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=265691; asn_org=WI-NET TELECOM S.A.C.",
      "id": "indicator--ef768eaf-2b17-4307-8a1f-e8c7cd3c1f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.25.30.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:05:12.000Z",
      "valid_until": "2026-06-04T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T00:45:27.015Z",
      "x_nadsec_last_seen": "2026-05-03T00:45:27.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "265691"
      ],
      "x_nadsec_orgs": [
        "WI-NET TELECOM S.A.C."
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--d5b30679-0fa1-445a-9285-d1fb308b002f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.162.117.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-03T01:46:40.951Z",
      "x_nadsec_last_seen": "2026-05-30T01:45:47.729Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mirrord; ports=42; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-05-03T01:47:12.072Z",
      "x_nadsec_last_seen": "2026-05-21T12:07:37.802Z",
      "x_nadsec_ports": [
        "42",
        "21",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "epmapper",
        "ftpd",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--9b75d0b9-5229-4200-bd16-0deb2a202316",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.83.200.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-03T01:54:58.882Z",
      "x_nadsec_last_seen": "2026-05-16T20:39:04.690Z",
      "x_nadsec_ports": [
        "1723",
        "1433"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=204272; asn_org=ASARTA LLC; user(top)=**",
      "id": "indicator--c2b4c59b-c3cb-4df3-99fe-f644e255293d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.108.209.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T01:53:29.007Z",
      "x_nadsec_last_seen": "2026-05-03T01:53:29.007Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "204272"
      ],
      "x_nadsec_orgs": [
        "ASARTA LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HR; asn=31012; asn_org=A1 Hrvatska d.o.o.; user(top)=**",
      "id": "indicator--65670833-3c10-496d-a091-825afdbc54b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.252.189.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T02:00:32.361Z",
      "x_nadsec_last_seen": "2026-05-03T02:00:32.361Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HR"
      ],
      "x_nadsec_asns": [
        "31012"
      ],
      "x_nadsec_orgs": [
        "A1 Hrvatska d.o.o."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--39bd1c58-e0f2-4af7-b2f8-3881a145f157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '207.154.217.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T01:12:30.386Z",
      "x_nadsec_last_seen": "2026-05-03T01:12:30.386Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--d1f6a82c-45c4-49a4-af7d-5618355c179d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.104.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T01:20:24.060Z",
      "x_nadsec_last_seen": "2026-05-03T01:20:24.060Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-03T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1c75a434-7397-4925-8a99-975a64d308cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.174.144.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:05:10.000Z",
      "valid_until": "2026-06-04T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T01:29:35.832Z",
      "x_nadsec_last_seen": "2026-05-26T22:46:30.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--36aefe97-98b6-45c6-9d1b-72b3c39f84b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.95.175.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:05:10.000Z",
      "valid_until": "2026-06-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T03:00:21.375Z",
      "x_nadsec_last_seen": "2026-05-29T17:00:06.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-03T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--39173942-06a0-4c8b-abb8-4cb05a7027b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.7.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:05:10.000Z",
      "valid_until": "2026-06-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T02:26:24.965Z",
      "x_nadsec_last_seen": "2026-05-03T02:28:29.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-03T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--37d9485b-5472-40c5-b15a-ea9c116489dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.9.49.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:05:10.000Z",
      "valid_until": "2026-06-04T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T02:06:06.343Z",
      "x_nadsec_last_seen": "2026-05-03T02:08:13.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-05-03T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--bda317dd-29b5-4b52-aa15-d4faf86f291f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.233.40.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:05:10.000Z",
      "valid_until": "2026-06-04T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T02:21:49.146Z",
      "x_nadsec_last_seen": "2026-05-03T02:21:49.146Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--34cc81c2-03f1-4a10-bb1a-8ca567f01596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:05:10.000Z",
      "valid_until": "2026-06-04T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T02:39:17.246Z",
      "x_nadsec_last_seen": "2026-05-03T02:39:17.565Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4bc1b8f5-b298-4f34-8b08-1b055ae2f208",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:05:10.000Z",
      "valid_until": "2026-06-04T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T02:39:10.571Z",
      "x_nadsec_last_seen": "2026-05-03T02:39:10.571Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--23aaf5d4-a4ab-4742-897c-37a46969874d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:05:10.000Z",
      "valid_until": "2026-06-04T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T02:30:39.419Z",
      "x_nadsec_last_seen": "2026-05-03T02:30:39.419Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b8e0f525-ac56-444f-b606-a1cc061d78cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.108.108.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:05:09.000Z",
      "valid_until": "2026-06-04T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T03:44:29.447Z",
      "x_nadsec_last_seen": "2026-05-03T03:44:29.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-03T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS; user(top)=**",
      "id": "indicator--9ea72ef1-9d51-474d-b378-3e5447de4db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.96.160.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:05:09.000Z",
      "valid_until": "2026-06-04T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T03:15:20.321Z",
      "x_nadsec_last_seen": "2026-05-03T03:15:20.321Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:05:09.000Z",
      "valid_until": "2026-06-04T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T03:20:17.315Z",
      "x_nadsec_last_seen": "2026-05-03T03:20:18.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ba38ea62-24af-4422-bef1-493566d4b83d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.250.168.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:05:09.000Z",
      "valid_until": "2026-06-04T04:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-03T03:44:25.290Z",
      "x_nadsec_last_seen": "2026-05-23T19:16:02.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-03T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--f6ef968a-fc8e-466a-9c50-e10f950f9dd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:05:09.000Z",
      "valid_until": "2026-06-04T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T03:29:46.804Z",
      "x_nadsec_last_seen": "2026-05-12T07:51:40.187Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-05-03T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=151858; asn_org=INTERDIGI JOINT STOCK COMPANY",
      "id": "indicator--d3430560-7773-4bf2-88fa-435015e5161e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.75.180.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:05:09.000Z",
      "valid_until": "2026-06-04T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T05:01:09.206Z",
      "x_nadsec_last_seen": "2026-05-03T05:01:09.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "151858"
      ],
      "x_nadsec_orgs": [
        "INTERDIGI JOINT STOCK COMPANY"
      ]
    },
    {
      "created": "2026-05-03T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC; user(top)=**",
      "id": "indicator--a60879b8-e50c-415e-a618-7293a59e5851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.32.58.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:05:09.000Z",
      "valid_until": "2026-06-04T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T04:46:41.503Z",
      "x_nadsec_last_seen": "2026-05-03T04:46:41.503Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--63928ab9-0177-4dda-afb2-a4e69e4743d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.8.131.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:05:09.000Z",
      "valid_until": "2026-06-04T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T04:53:50.372Z",
      "x_nadsec_last_seen": "2026-05-03T04:55:55.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-03T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d3a61a1d-ac90-4dcd-9a87-59ffea75ddce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:05:09.000Z",
      "valid_until": "2026-06-04T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T04:51:09.352Z",
      "x_nadsec_last_seen": "2026-05-27T13:06:07.812Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=45685; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ca88fc30-5a1b-4e1d-8fb2-305740aad95f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:05:09.000Z",
      "valid_until": "2026-06-04T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T04:07:56.676Z",
      "x_nadsec_last_seen": "2026-05-03T04:07:56.680Z",
      "x_nadsec_ports": [
        "42",
        "45685"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-03T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=37173; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce6d399a-1cbb-4ad6-bc7e-cee7b5ced971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:05:09.000Z",
      "valid_until": "2026-06-04T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T04:07:57.648Z",
      "x_nadsec_last_seen": "2026-05-03T04:07:57.652Z",
      "x_nadsec_ports": [
        "42",
        "37173"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--b1749e2f-accb-4b88-9d0e-6b37be08b8a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.54.133.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T05:47:59.543Z",
      "x_nadsec_last_seen": "2026-05-03T05:48:24.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=13876; asn_org=FiberLight, LLC",
      "id": "indicator--56ce9b36-845b-4100-94e4-5b75397b8935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.63.149.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T05:59:49.134Z",
      "x_nadsec_last_seen": "2026-05-08T11:03:57.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "13876"
      ],
      "x_nadsec_orgs": [
        "FiberLight, LLC"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--bc6278cf-c834-4b2e-a2ac-aaed626768f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.196.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T05:29:12.643Z",
      "x_nadsec_last_seen": "2026-05-03T05:29:28.919Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--0fe675c5-d6d5-4321-8b5a-a83868376564",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.196.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T05:29:12.950Z",
      "x_nadsec_last_seen": "2026-05-03T05:29:49.720Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--c91d9840-6ab6-4503-9208-a0cb90dd08b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.196.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T05:29:15.799Z",
      "x_nadsec_last_seen": "2026-05-03T05:29:21.758Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--3e7a69f2-4dd4-4f2c-a85a-f0b67baf9773",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.196.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T05:29:17.443Z",
      "x_nadsec_last_seen": "2026-05-03T05:29:31.664Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SV; asn=14754; asn_org=TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA; user(top)=**",
      "id": "indicator--eac513e9-1ffc-4f8e-8b9e-0bf7b081b02d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.86.199.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T05:18:12.659Z",
      "x_nadsec_last_seen": "2026-05-05T13:32:45.835Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "14754"
      ],
      "x_nadsec_orgs": [
        "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--437e6367-1117-4588-8934-6abdaa4cbbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T05:31:35.222Z",
      "x_nadsec_last_seen": "2026-05-03T05:31:35.222Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--74564442-648c-448e-9cb9-4dcad34b44ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T05:46:02.299Z",
      "x_nadsec_last_seen": "2026-05-19T16:06:44.852Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--e6e4da75-6e49-4d5d-9f4a-baa5bd57831c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.99.189.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T05:33:29.315Z",
      "x_nadsec_last_seen": "2026-05-10T05:27:29.718Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T05:28:25.492Z",
      "x_nadsec_last_seen": "2026-05-30T00:13:47.511Z",
      "x_nadsec_ports": [
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a2ef8ef9-7265-41e4-bc40-cd063072f0e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.101.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T05:39:49.108Z",
      "x_nadsec_last_seen": "2026-05-03T05:40:12.661Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--02233260-9932-4056-b92c-67fcac37ef9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T05:30:37.068Z",
      "x_nadsec_last_seen": "2026-05-13T14:46:21.699Z",
      "x_nadsec_ports": [
        "3306",
        "81"
      ],
      "x_nadsec_services": [
        "mysqld",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3986cc22-3e53-49c0-8b8d-417ec5b90a56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T05:30:47.317Z",
      "x_nadsec_last_seen": "2026-05-03T05:30:47.317Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6a0cfba4-3e42-4d7f-93b6-a771a5053709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T05:49:43.996Z",
      "x_nadsec_last_seen": "2026-05-03T05:49:43.996Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-03T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7d13bf99-3cc5-45d6-862f-89c884e64f23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:05:10.000Z",
      "valid_until": "2026-06-04T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T05:49:44.484Z",
      "x_nadsec_last_seen": "2026-05-03T05:49:44.484Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=141805; asn_org=Hubcom Techno System Llp; user(top)=**",
      "id": "indicator--326e2c3c-41bb-4e7a-b159-7a1c884f6d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.109.139.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T06:37:57.280Z",
      "x_nadsec_last_seen": "2026-05-03T06:37:57.280Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141805"
      ],
      "x_nadsec_orgs": [
        "Hubcom Techno System Llp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=56; services=mirrorc; ports=38539; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e47f7991-9e22-4446-a2b6-3ab715dd58e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.173.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 146,
      "x_nadsec_first_seen": "2026-05-03T07:01:35.085Z",
      "x_nadsec_last_seen": "2026-05-03T07:10:35.409Z",
      "x_nadsec_ports": [
        "42",
        "32865",
        "32903",
        "33045",
        "33099",
        "33223",
        "33619",
        "34133",
        "34173",
        "34619"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5247cd0d-0bc7-4467-bd8d-d49879fd7de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.157.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T06:26:29.735Z",
      "x_nadsec_last_seen": "2026-05-03T06:26:29.735Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e59c68c9-cc0e-427f-bb79-7258e15e9d0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.241.128.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T06:09:02.103Z",
      "x_nadsec_last_seen": "2026-05-04T08:26:01.399Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T06:19:08.177Z",
      "x_nadsec_last_seen": "2026-05-31T21:49:09.114Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--37076e74-ea5b-424a-b7ff-525836972a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.221.72.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T06:15:49.852Z",
      "x_nadsec_last_seen": "2026-05-20T05:01:11.444Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5ef1cd45-cbb2-464e-a3b0-26ea78e0b925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.80.83.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T06:59:27.912Z",
      "x_nadsec_last_seen": "2026-05-25T04:45:18.181Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b42272d5-cf25-48c1-9220-2ffd451cacab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.34.163.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T06:32:04.890Z",
      "x_nadsec_last_seen": "2026-05-03T06:32:42.266Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8ffeb959-8228-4050-851e-f0f55d7540e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.241.196.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T06:31:20.137Z",
      "x_nadsec_last_seen": "2026-05-03T06:31:20.137Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--ca07831a-ebff-4518-acfa-9954d1e10360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T07:00:16.152Z",
      "x_nadsec_last_seen": "2026-05-28T19:43:03.890Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB",
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T06:32:42.450Z",
      "x_nadsec_last_seen": "2026-05-26T07:32:32.072Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0583ce09-d488-4c3d-abc0-9a3eec0cecb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.137.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:05:10.000Z",
      "valid_until": "2026-06-04T07:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-03T06:06:09.683Z",
      "x_nadsec_last_seen": "2026-05-03T06:08:58.766Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=396356; asn_org=Latitude.sh; user(top)=r**t; pass(top)=s****3",
      "id": "indicator--00480e94-68f3-455f-9eb9-ba033878afc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.144.35.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:05:10.000Z",
      "valid_until": "2026-06-04T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T07:06:13.719Z",
      "x_nadsec_last_seen": "2026-05-03T07:06:50.710Z",
      "x_nadsec_ports": [
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396356"
      ],
      "x_nadsec_orgs": [
        "Latitude.sh"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "s****3"
      ]
    },
    {
      "created": "2026-05-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1e958029-fef7-46b3-9af9-8b72b9e5e50c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.142.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:05:10.000Z",
      "valid_until": "2026-06-04T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T07:17:37.871Z",
      "x_nadsec_last_seen": "2026-05-03T07:17:37.871Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b81e65de-3473-4f1b-8d9e-2153d1915435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:05:10.000Z",
      "valid_until": "2026-06-04T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T07:35:24.599Z",
      "x_nadsec_last_seen": "2026-05-03T07:35:24.599Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bfae77f7-efb8-4156-a899-2c5c964ef309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:05:10.000Z",
      "valid_until": "2026-06-04T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T07:47:54.913Z",
      "x_nadsec_last_seen": "2026-05-03T07:47:54.913Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--786241da-260a-4072-a90c-2b4ee8cc4bb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.87.153.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:05:10.000Z",
      "valid_until": "2026-06-04T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T07:53:12.146Z",
      "x_nadsec_last_seen": "2026-05-03T07:54:39.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-03T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:05:10.000Z",
      "valid_until": "2026-06-04T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T07:35:01.853Z",
      "x_nadsec_last_seen": "2026-05-20T10:19:46.777Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--cf249ae9-1ae4-4a9d-b09a-495c41a2f6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.154.84.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:05:01.000Z",
      "valid_until": "2026-06-04T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T08:18:01.191Z",
      "x_nadsec_last_seen": "2026-05-03T08:18:01.191Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=3132; asn_org=Red Cientifica Peruana",
      "id": "indicator--c5bdec3f-6172-4274-acf9-3a007a2db1e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.132.56.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:05:01.000Z",
      "valid_until": "2026-06-04T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T08:17:06.654Z",
      "x_nadsec_last_seen": "2026-05-17T16:12:10.167Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "3132"
      ],
      "x_nadsec_orgs": [
        "Red Cientifica Peruana"
      ]
    },
    {
      "created": "2026-05-03T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--2b6fb025-8e4a-40d1-a002-fb542cac9d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:05:01.000Z",
      "valid_until": "2026-06-04T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T08:05:47.742Z",
      "x_nadsec_last_seen": "2026-05-03T08:05:47.742Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-03T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--f5e988e6-835b-4f73-9ceb-5e726b394aea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:05:01.000Z",
      "valid_until": "2026-06-04T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T08:05:48.183Z",
      "x_nadsec_last_seen": "2026-05-03T08:05:48.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-03T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a0a649fd-dd82-41c9-a002-9b3373b4bd60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:05:01.000Z",
      "valid_until": "2026-06-04T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T08:46:02.342Z",
      "x_nadsec_last_seen": "2026-05-03T08:46:02.342Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T09:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a06b0608-4886-4f58-a792-1f8efd0a3345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T09:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:05:01.000Z",
      "valid_until": "2026-06-04T09:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T09:02:43.547Z",
      "x_nadsec_last_seen": "2026-05-17T21:30:47.705Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3145; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--17a2d0e7-0622-4e23-b368-1a0246b29f3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.236.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:05:10.000Z",
      "valid_until": "2026-06-04T10:05:09.000Z",
      "x_nadsec_event_count": 3145,
      "x_nadsec_first_seen": "2026-05-03T09:30:35.742Z",
      "x_nadsec_last_seen": "2026-05-03T10:02:59.637Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-03T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:05:10.000Z",
      "valid_until": "2026-06-04T10:05:09.000Z",
      "x_nadsec_event_count": 262,
      "x_nadsec_first_seen": "2026-05-03T09:44:53.754Z",
      "x_nadsec_last_seen": "2026-05-13T01:55:35.409Z",
      "x_nadsec_ports": [
        "21",
        "1433",
        "1723",
        "3306",
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld",
        "mysqld",
        "pptpd",
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-03T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--83f87abe-7a6e-4b76-9bdd-07818e6d84bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.65.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:05:10.000Z",
      "valid_until": "2026-06-04T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T09:59:21.881Z",
      "x_nadsec_last_seen": "2026-05-03T10:01:26.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-03T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--3eee48b0-e910-406b-8804-3da66f877d67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.135.94.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:05:10.000Z",
      "valid_until": "2026-06-04T10:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-03T09:21:51.711Z",
      "x_nadsec_last_seen": "2026-05-04T07:42:20.424Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n",
        "A***********r",
        "P******p"
      ],
      "x_nadsec_passwords_attempted": [
        "A***********r",
        "P******p",
        "a******3",
        "p******d"
      ]
    },
    {
      "created": "2026-05-03T11:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T11:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:05:19.000Z",
      "valid_until": "2026-06-04T11:05:17.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T10:51:14.723Z",
      "x_nadsec_last_seen": "2026-05-20T14:13:05.798Z",
      "x_nadsec_ports": [
        "81",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-03T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c2ad7f7b-3a2b-4289-a9aa-010599c19336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.102.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:05:10.000Z",
      "valid_until": "2026-06-04T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T11:30:52.206Z",
      "x_nadsec_last_seen": "2026-05-03T11:32:59.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-03T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1226c05c-6951-4e6a-b6bd-5faa7367ad2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.4.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:05:10.000Z",
      "valid_until": "2026-06-04T12:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-03T11:22:35.552Z",
      "x_nadsec_last_seen": "2026-05-29T15:27:16.712Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--11c15d64-b857-4685-8545-843d3c5029c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.208.24.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:05:10.000Z",
      "valid_until": "2026-06-04T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T11:59:44.844Z",
      "x_nadsec_last_seen": "2026-05-03T11:59:45.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:05:10.000Z",
      "valid_until": "2026-06-04T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T11:06:16.081Z",
      "x_nadsec_last_seen": "2026-05-28T14:49:36.492Z",
      "x_nadsec_ports": [
        "27017",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-03T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--703a5ba5-b1d1-4cd4-b7fd-e47df7edd98f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.224.242.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:05:10.000Z",
      "valid_until": "2026-06-04T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T11:15:50.282Z",
      "x_nadsec_last_seen": "2026-05-03T11:15:51.056Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--d5978b06-5f67-405b-b9df-18d14217ea88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.79.191.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:05:10.000Z",
      "valid_until": "2026-06-04T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T11:31:56.910Z",
      "x_nadsec_last_seen": "2026-05-03T11:34:04.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-05-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=134749; asn_org=SPEED TECH ONLINE",
      "id": "indicator--d06ee34a-9df9-4967-87d7-765e0c624e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.199.155.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:05:10.000Z",
      "valid_until": "2026-06-04T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T12:35:24.477Z",
      "x_nadsec_last_seen": "2026-05-03T12:37:29.333Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "134749"
      ],
      "x_nadsec_orgs": [
        "SPEED TECH ONLINE"
      ]
    },
    {
      "created": "2026-05-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--ab3cde26-7100-4af2-9009-f550eb76744d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:05:10.000Z",
      "valid_until": "2026-06-04T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T12:06:32.312Z",
      "x_nadsec_last_seen": "2026-05-03T12:08:39.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--393ade05-09ea-4d0f-8981-20791a03e57e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:05:10.000Z",
      "valid_until": "2026-06-04T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T12:30:34.805Z",
      "x_nadsec_last_seen": "2026-05-03T12:30:34.805Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e16ade22-9edc-4d70-be0f-61ab268a03c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.138.203.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:05:10.000Z",
      "valid_until": "2026-06-04T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T12:54:05.490Z",
      "x_nadsec_last_seen": "2026-05-03T13:00:51.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f4e244ce-8d18-4189-9aa4-afb7fdda54e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:05:10.000Z",
      "valid_until": "2026-06-04T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T12:37:15.778Z",
      "x_nadsec_last_seen": "2026-05-28T07:44:24.087Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--6632b7db-fcec-47d3-8122-1d738dd44fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:05:10.000Z",
      "valid_until": "2026-06-04T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T12:50:52.392Z",
      "x_nadsec_last_seen": "2026-05-03T12:50:52.392Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-05-03T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--39bfb757-c089-4cc9-a42a-b90eeb5c3cc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.80.211.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:05:09.000Z",
      "valid_until": "2026-06-04T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T13:53:51.300Z",
      "x_nadsec_last_seen": "2026-05-03T13:55:58.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-03T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a5df3e8c-6060-40c9-8693-ef80cb669d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.171.241.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:05:09.000Z",
      "valid_until": "2026-06-04T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T13:08:40.171Z",
      "x_nadsec_last_seen": "2026-05-03T13:08:40.171Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--1719b150-3148-4c0c-8f37-c39f717da397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.133.44.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:05:09.000Z",
      "valid_until": "2026-06-04T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T13:29:22.729Z",
      "x_nadsec_last_seen": "2026-05-03T13:29:22.729Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--2d4b8455-841f-40f0-bd04-28519034dab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.216.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:05:09.000Z",
      "valid_until": "2026-06-04T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T13:34:58.506Z",
      "x_nadsec_last_seen": "2026-05-20T13:40:25.067Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--8bf2a44a-7cb7-4b95-b0b7-1ebd0b826ce4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:05:04.000Z",
      "valid_until": "2026-06-04T15:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T14:08:29.548Z",
      "x_nadsec_last_seen": "2026-05-03T14:08:29.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-03T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:05:04.000Z",
      "valid_until": "2026-06-04T15:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T14:37:31.672Z",
      "x_nadsec_last_seen": "2026-05-03T14:37:31.672Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-03T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8d6cb90a-561e-4dad-873a-6b7ef768d103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:05:04.000Z",
      "valid_until": "2026-06-04T15:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T14:36:35.813Z",
      "x_nadsec_last_seen": "2026-05-03T14:36:35.813Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=8452; asn_org=TE Data; user(top)=**",
      "id": "indicator--f3d7daf1-5437-4c5f-87d0-91a78d7368db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.178.183.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:05:05.000Z",
      "valid_until": "2026-06-04T16:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T15:55:43.579Z",
      "x_nadsec_last_seen": "2026-05-03T15:55:43.579Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--34953cfe-353e-4f40-9db2-64f2ed9168c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.183.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:05:05.000Z",
      "valid_until": "2026-06-04T16:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T15:19:42.303Z",
      "x_nadsec_last_seen": "2026-05-03T15:19:45.581Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e8136260-3f4f-4a7e-8c07-091c53f7813a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:05:05.000Z",
      "valid_until": "2026-06-04T16:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T15:13:30.469Z",
      "x_nadsec_last_seen": "2026-05-19T17:27:23.130Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7287af32-b684-4715-b218-8ea60008e92f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.150.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:05:05.000Z",
      "valid_until": "2026-06-04T16:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T15:27:18.195Z",
      "x_nadsec_last_seen": "2026-05-03T15:27:18.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-03T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:05:05.000Z",
      "valid_until": "2026-06-04T16:05:04.000Z",
      "x_nadsec_event_count": 823,
      "x_nadsec_first_seen": "2026-05-03T15:54:44.860Z",
      "x_nadsec_last_seen": "2026-05-29T03:25:00.918Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "1433",
        "1723",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd",
        "mssqld",
        "pptpd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-03T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1994; services=smbd; ports=445; cc=TR; asn=47331; asn_org=Turk Telekom",
      "id": "indicator--94c4918d-dd3b-4523-a586-cdb025fd414d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.238.167.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:05:05.000Z",
      "valid_until": "2026-06-04T16:05:04.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-05-03T15:27:40.334Z",
      "x_nadsec_last_seen": "2026-05-03T16:23:46.744Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "47331"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-03T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--a1568a53-83a4-4d56-aaec-9bf797dc8b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.25.178.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:05:05.000Z",
      "valid_until": "2026-06-04T16:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T15:48:29.556Z",
      "x_nadsec_last_seen": "2026-05-03T15:50:31.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-03T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a67b35fc-cbad-40e6-b6f5-0d7b2de88281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.136.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:05:10.000Z",
      "valid_until": "2026-06-04T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T16:34:30.994Z",
      "x_nadsec_last_seen": "2026-05-03T16:34:30.994Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-03T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--27c2eb68-2eea-4d57-b97f-fa2baf3c6404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:05:10.000Z",
      "valid_until": "2026-06-04T17:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T16:31:37.615Z",
      "x_nadsec_last_seen": "2026-05-21T18:31:52.607Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-03T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=132839; asn_org=POWER LINE DATACENTER; user(top)=**",
      "id": "indicator--ac3311fa-89ec-4753-be08-cb6eedf08f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.54.162.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:05:10.000Z",
      "valid_until": "2026-06-04T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T17:48:46.576Z",
      "x_nadsec_last_seen": "2026-05-03T17:48:46.576Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132839"
      ],
      "x_nadsec_orgs": [
        "POWER LINE DATACENTER"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ee8dc2bd-acc8-4279-9d0d-0674e993f96c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:05:10.000Z",
      "valid_until": "2026-06-04T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T17:57:05.769Z",
      "x_nadsec_last_seen": "2026-05-03T17:57:35.515Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-03T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--2583cd5e-c79f-4489-975a-8b2bed3e955c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.95.22.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:05:10.000Z",
      "valid_until": "2026-06-04T18:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-03T18:04:41.285Z",
      "x_nadsec_last_seen": "2026-05-28T23:31:18.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-03T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--70295adf-058c-4a27-98f2-131c8e285015",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:05:10.000Z",
      "valid_until": "2026-06-04T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T17:58:42.210Z",
      "x_nadsec_last_seen": "2026-05-03T17:58:42.210Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-03T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:05:10.000Z",
      "valid_until": "2026-06-04T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T17:30:03.726Z",
      "x_nadsec_last_seen": "2026-05-07T20:40:13.358Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--3231a295-d22d-4121-a1c3-c5f1a813a440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:05:10.000Z",
      "valid_until": "2026-06-04T18:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-03T17:47:46.500Z",
      "x_nadsec_last_seen": "2026-05-03T17:48:26.763Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-03T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8931c6f2-1806-4d05-9b20-d8b1c53761a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:05:10.000Z",
      "valid_until": "2026-06-04T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T18:03:43.688Z",
      "x_nadsec_last_seen": "2026-05-23T22:25:48.595Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T19:44:12.599Z",
      "x_nadsec_last_seen": "2026-05-03T19:44:12.599Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cacc9598-d4d9-4fe3-9e69-450503f2ed05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.185.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-03T20:02:44.203Z",
      "x_nadsec_last_seen": "2026-05-12T00:56:45.678Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--1b73391f-a578-41ad-9fe0-f0a8b36b7f65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.63.141.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T19:17:43.008Z",
      "x_nadsec_last_seen": "2026-05-03T19:17:43.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T20:00:52.809Z",
      "x_nadsec_last_seen": "2026-05-03T20:00:52.809Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--5062a79b-b85f-4d42-8cd8-ed3b120753ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.114.122.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T19:46:48.043Z",
      "x_nadsec_last_seen": "2026-05-03T19:48:57.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--be621ce7-d110-491b-982c-2df9ba7c3fc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T19:10:56.863Z",
      "x_nadsec_last_seen": "2026-05-03T19:10:56.863Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--fb7c07d3-f96e-4d04-a2f2-fb07778db5b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T19:26:38.705Z",
      "x_nadsec_last_seen": "2026-05-03T19:26:38.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-03T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--07c289a9-6c78-4ab4-9498-f5aaae152185",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:05:10.000Z",
      "valid_until": "2026-06-04T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T19:50:24.704Z",
      "x_nadsec_last_seen": "2026-05-23T07:18:03.397Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--13ec7ea3-7768-41a1-b251-7bdd09f54f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.161.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T21:00:48.513Z",
      "x_nadsec_last_seen": "2026-05-31T11:55:47.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--9959bc36-7996-4dbe-9aff-03f5e85d92d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.74.222.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T21:02:52.483Z",
      "x_nadsec_last_seen": "2026-05-31T11:57:51.568Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f0ffea1b-15ac-4152-9c93-2f9d4ce011e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T20:16:00.395Z",
      "x_nadsec_last_seen": "2026-05-03T20:16:00.426Z",
      "x_nadsec_ports": [
        "42",
        "41253"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=63023; asn_org=GTHost",
      "id": "indicator--0639229f-51ae-4c27-8210-bb5f7844dee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.168.103.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T20:22:24.967Z",
      "x_nadsec_last_seen": "2026-05-03T20:22:24.967Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "63023"
      ],
      "x_nadsec_orgs": [
        "GTHost"
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T20:12:16.740Z",
      "x_nadsec_last_seen": "2026-05-30T04:08:58.842Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T20:33:00.137Z",
      "x_nadsec_last_seen": "2026-05-24T22:00:23.962Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=11976; asn_org=Fidelity Communication International Inc.",
      "id": "indicator--37e673be-b947-4dff-92fd-1cc83bcffb8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.139.32.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T20:59:59.428Z",
      "x_nadsec_last_seen": "2026-05-03T20:59:59.635Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11976"
      ],
      "x_nadsec_orgs": [
        "Fidelity Communication International Inc."
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--fc6a62d4-3621-4c46-880e-6dafe987491c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-03T20:30:39.467Z",
      "x_nadsec_last_seen": "2026-05-29T04:35:33.875Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-03T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:05:10.000Z",
      "valid_until": "2026-06-04T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T20:49:47.168Z",
      "x_nadsec_last_seen": "2026-05-25T01:15:21.842Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-03T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=7552; asn_org=Viettel Group; user(top)=**",
      "id": "indicator--3fe5b0c7-a4aa-4f61-80a0-a32780a004ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.74.224.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:05:09.000Z",
      "valid_until": "2026-06-04T22:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T21:30:12.679Z",
      "x_nadsec_last_seen": "2026-05-21T00:55:03.334Z",
      "x_nadsec_ports": [
        "3306",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=45899; asn_org=VNPT Corp; user(top)=**",
      "id": "indicator--003e65a9-34ad-4f91-89b2-41a822bd566c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.183.212.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:05:09.000Z",
      "valid_until": "2026-06-04T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T21:30:12.806Z",
      "x_nadsec_last_seen": "2026-05-03T21:30:12.806Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:05:09.000Z",
      "valid_until": "2026-06-04T22:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T21:22:45.028Z",
      "x_nadsec_last_seen": "2026-05-17T03:55:42.635Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-03T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=153056; asn_org=Dedicated Freight Corridor Corporation of India Limited",
      "id": "indicator--7c5a24cd-6ea7-4ac3-b8e9-9b550769cac6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.101.187.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:05:09.000Z",
      "valid_until": "2026-06-04T22:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-03T21:24:39.925Z",
      "x_nadsec_last_seen": "2026-05-03T21:31:57.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "153056"
      ],
      "x_nadsec_orgs": [
        "Dedicated Freight Corridor Corporation of India Limited"
      ]
    },
    {
      "created": "2026-05-03T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--b5c39848-83fa-4911-a9b2-89bb6553f807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.231.148.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:05:09.000Z",
      "valid_until": "2026-06-04T22:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-03T21:09:45.651Z",
      "x_nadsec_last_seen": "2026-05-03T21:10:16.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-05-03T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--0d934a2f-a804-4cad-826e-f0d53768e8a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.222.128.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:05:09.000Z",
      "valid_until": "2026-06-04T22:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-03T21:50:55.560Z",
      "x_nadsec_last_seen": "2026-05-25T21:26:11.861Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-03T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=151734; asn_org=WEBYNE DATA CENTRE PRIVATE LIMITED; user(top)=**",
      "id": "indicator--81e6c608-c640-4889-9b5b-971c1f84efee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.99.36.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:05:10.000Z",
      "valid_until": "2026-06-04T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T22:43:06.654Z",
      "x_nadsec_last_seen": "2026-05-03T22:43:06.654Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151734"
      ],
      "x_nadsec_orgs": [
        "WEBYNE DATA CENTRE PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-03T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies",
      "id": "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-03T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T23:05:10.000Z",
      "valid_until": "2026-06-04T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T22:57:48.411Z",
      "x_nadsec_last_seen": "2026-05-07T04:42:19.358Z",
      "x_nadsec_ports": [
        "3306",
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210259"
      ],
      "x_nadsec_orgs": [
        "LLC Applied Computational Technologies"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--61b4f97f-0dd4-4358-b138-d76bbe9f83e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:05:09.000Z",
      "valid_until": "2026-06-05T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-03T23:35:37.760Z",
      "x_nadsec_last_seen": "2026-05-03T23:35:37.760Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T00:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--6f81ab7a-8b30-4823-9f4a-61bfcc0144b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T00:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.88.222.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T00:05:09.000Z",
      "valid_until": "2026-06-05T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-03T23:38:48.388Z",
      "x_nadsec_last_seen": "2026-05-03T23:38:48.976Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=29289; asn_org=Georgian Technical University",
      "id": "indicator--70dd3e90-0065-4b98-8390-ac77a4f66630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.205.46.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:05:10.000Z",
      "valid_until": "2026-06-05T01:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-04T00:17:23.354Z",
      "x_nadsec_last_seen": "2026-05-08T08:31:06.713Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "29289"
      ],
      "x_nadsec_orgs": [
        "Georgian Technical University"
      ]
    },
    {
      "created": "2026-05-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--b4f0777e-7209-4031-853d-6f5af8d8436b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.222.161.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:05:10.000Z",
      "valid_until": "2026-06-05T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T01:02:21.669Z",
      "x_nadsec_last_seen": "2026-05-04T01:02:21.669Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:05:10.000Z",
      "valid_until": "2026-06-05T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T00:57:59.227Z",
      "x_nadsec_last_seen": "2026-05-14T19:33:59.417Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0cc25d64-e498-465d-8058-7ead53f5e0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:05:10.000Z",
      "valid_until": "2026-06-05T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T00:36:03.268Z",
      "x_nadsec_last_seen": "2026-05-04T00:36:13.427Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--8b26d3ab-bea6-4346-ba6c-887889b7ebd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.33.193.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:05:10.000Z",
      "valid_until": "2026-06-05T01:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-05-04T00:14:10.571Z",
      "x_nadsec_last_seen": "2026-05-24T14:28:21.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-04T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--bc8d371e-1c78-4ed8-a1c0-2166b67b947a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '96.246.234.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:05:10.000Z",
      "valid_until": "2026-06-05T01:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-04T00:23:55.335Z",
      "x_nadsec_last_seen": "2026-05-14T00:40:58.587Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8db85ef7-512f-4ab9-84aa-d796807bb594",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T01:21:30.513Z",
      "x_nadsec_last_seen": "2026-05-04T01:21:40.683Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=41585; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ee94b310-1e82-430b-b687-09a83107ddae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.170.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T01:11:22.099Z",
      "x_nadsec_last_seen": "2026-05-04T01:11:22.102Z",
      "x_nadsec_ports": [
        "42",
        "41585"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4f313847-9e3e-4933-a4ba-dce7d8b549ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.242.104.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-04T01:19:19.209Z",
      "x_nadsec_last_seen": "2026-05-11T02:56:39.690Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T01:33:07.638Z",
      "x_nadsec_last_seen": "2026-05-20T02:10:29.898Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--990b72a3-a475-41aa-a0e7-9333ab493616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.214.212.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T01:16:08.515Z",
      "x_nadsec_last_seen": "2026-05-04T01:24:07.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--52e059ff-e940-4701-9f3a-854a87ab3744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T01:29:29.396Z",
      "x_nadsec_last_seen": "2026-05-04T01:29:29.396Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--90f0f14f-3f26-4acd-b0a7-a54ca9f96515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.245.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T02:03:07.087Z",
      "x_nadsec_last_seen": "2026-05-04T02:03:07.087Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--12369dce-846f-4287-ab34-02993b717d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T01:36:16.594Z",
      "x_nadsec_last_seen": "2026-05-30T19:15:33.648Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.80.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-04T01:42:10.135Z",
      "x_nadsec_last_seen": "2026-05-22T11:35:15.269Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-04T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--71fa9a05-b14e-4624-bbd6-17cd74b2bd1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.247.99.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:05:09.000Z",
      "valid_until": "2026-06-05T02:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T01:37:57.233Z",
      "x_nadsec_last_seen": "2026-05-28T07:45:40.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a3f6cd8d-1163-4b8e-8c88-1130252612f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.199.4.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:05:10.000Z",
      "valid_until": "2026-06-05T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T02:33:34.664Z",
      "x_nadsec_last_seen": "2026-05-12T05:16:26.698Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8b043326-3050-444a-8f7f-d7da8f7e6732",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.157.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:05:10.000Z",
      "valid_until": "2026-06-05T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T03:01:12.130Z",
      "x_nadsec_last_seen": "2026-05-04T03:01:49.268Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--1d463952-667b-4259-83c5-de0284fbcc17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.197.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:05:10.000Z",
      "valid_until": "2026-06-05T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T02:33:35.298Z",
      "x_nadsec_last_seen": "2026-05-25T14:26:35.194Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--60fb8536-e840-40b4-9b4e-acf53f2cfa99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.189.203.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:05:10.000Z",
      "valid_until": "2026-06-05T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T03:01:10.731Z",
      "x_nadsec_last_seen": "2026-05-04T03:01:10.731Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.215.219.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:05:10.000Z",
      "valid_until": "2026-06-05T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T03:01:44.323Z",
      "x_nadsec_last_seen": "2026-05-04T03:01:44.323Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--07cde71b-42a5-4584-b802-481d49fb4dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.231.5.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:05:10.000Z",
      "valid_until": "2026-06-05T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T02:47:14.386Z",
      "x_nadsec_last_seen": "2026-05-04T02:49:20.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-05-04T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mysqld; ports=3306; cc=NL; asn=62068; asn_org=SpectraIP B.V.; user(top)=a***********r",
      "id": "indicator--d93e7555-653f-431d-833e-7c223021417c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.182.209.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:05:10.000Z",
      "valid_until": "2026-06-05T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T02:42:20.052Z",
      "x_nadsec_last_seen": "2026-05-04T02:43:58.548Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "62068"
      ],
      "x_nadsec_orgs": [
        "SpectraIP B.V."
      ],
      "x_nadsec_usernames_attempted": [
        "a***********r",
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KH; asn=38623; asn_org=ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.",
      "id": "indicator--e7c9860f-4b23-47d1-a24d-d9ff3b4882be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.13.157.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T03:45:30.457Z",
      "x_nadsec_last_seen": "2026-05-04T03:51:56.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38623"
      ],
      "x_nadsec_orgs": [
        "ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE."
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--ae502d69-10aa-44b7-8a6c-59c22c67f2fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.139.122.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-04T03:57:58.441Z",
      "x_nadsec_last_seen": "2026-05-22T15:00:17.348Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--11844ce7-c0ee-48d0-b27e-a8e6e12a8ead",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.43.58.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-04T03:57:24.576Z",
      "x_nadsec_last_seen": "2026-05-04T03:57:29.012Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=RS; asn=31042; asn_org=Serbia BroadBand-Srpske Kablovske mreze d.o.o.",
      "id": "indicator--ebe4dd08-768f-401f-8f28-45cd8d01b12d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.240.142.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-04T03:06:40.016Z",
      "x_nadsec_last_seen": "2026-05-04T03:30:27.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "31042"
      ],
      "x_nadsec_orgs": [
        "Serbia BroadBand-Srpske Kablovske mreze d.o.o."
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T03:37:49.893Z",
      "x_nadsec_last_seen": "2026-05-04T03:37:49.893Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=207103; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--9f7b719b-77a5-49e8-ae10-3bfc87599b02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.172.17.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T03:39:22.445Z",
      "x_nadsec_last_seen": "2026-05-04T03:47:27.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "207103"
      ],
      "x_nadsec_orgs": [
        "LLC Cifrovie Seti Urala"
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--092f8378-5411-4790-a4df-ccfc23817bda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.208.72.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T03:44:04.328Z",
      "x_nadsec_last_seen": "2026-05-12T00:23:05.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-04T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T04:05:04.000Z",
      "valid_until": "2026-06-05T04:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T04:01:07.088Z",
      "x_nadsec_last_seen": "2026-05-27T17:28:42.603Z",
      "x_nadsec_ports": [
        "27017",
        "1433",
        "21",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld",
        "ftpd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-04T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db713fa9-f38f-49db-a1f0-10be71522e52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:05:09.000Z",
      "valid_until": "2026-06-05T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T04:35:44.144Z",
      "x_nadsec_last_seen": "2026-05-20T00:19:19.283Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--045fb830-b5a4-471a-ab87-fe8de9dcb34d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.248.86.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:05:09.000Z",
      "valid_until": "2026-06-05T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T04:25:07.791Z",
      "x_nadsec_last_seen": "2026-05-04T04:27:13.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-05-04T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:05:09.000Z",
      "valid_until": "2026-06-05T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T04:35:57.894Z",
      "x_nadsec_last_seen": "2026-05-30T13:33:51.624Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T05:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f40fcd60-e4ae-4d2d-8ba9-d385d3fb2f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T05:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.210.123.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:05:09.000Z",
      "valid_until": "2026-06-05T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T04:13:20.449Z",
      "x_nadsec_last_seen": "2026-05-10T14:14:42.633Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=46606; asn_org=Unified Layer",
      "id": "indicator--ec6c87ad-652c-453f-badc-1dcc15e37fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.214.98.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T05:49:09.551Z",
      "x_nadsec_last_seen": "2026-05-30T19:43:50.450Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "46606"
      ],
      "x_nadsec_orgs": [
        "Unified Layer"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ae2cf2fc-d7e2-4418-97d2-3c8bc85d2871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.92.225.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T05:37:11.948Z",
      "x_nadsec_last_seen": "2026-05-04T05:37:11.948Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mssqld; ports=1433; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8ae02f84-9bc0-4d70-b65a-52794d84cfed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.162.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T06:00:17.572Z",
      "x_nadsec_last_seen": "2026-05-04T06:03:15.150Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e8b8c8d6-e915-4af5-bd6b-1c85b931eb97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.75.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T05:37:23.199Z",
      "x_nadsec_last_seen": "2026-05-04T05:37:23.199Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--40079a0c-b66d-4f04-9d88-a20d2108711a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.245.213.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T05:36:59.635Z",
      "x_nadsec_last_seen": "2026-05-04T05:37:10.941Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--57f0800f-810a-4829-8448-3257052b98f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.178.49.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T05:12:39.468Z",
      "x_nadsec_last_seen": "2026-05-04T05:19:58.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--c7acc53e-b4fe-4002-9d0a-79bd33bb419a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.196.198.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T05:25:59.983Z",
      "x_nadsec_last_seen": "2026-05-04T05:26:05.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--09812197-ef1b-445f-8e35-63520c8cf11f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.219.75.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T05:57:10.698Z",
      "x_nadsec_last_seen": "2026-05-04T05:57:10.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c1583308-06cb-4745-83be-7630f1bcb62d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T05:47:40.979Z",
      "x_nadsec_last_seen": "2026-05-04T05:47:40.979Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:05:10.000Z",
      "valid_until": "2026-06-05T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T05:43:14.890Z",
      "x_nadsec_last_seen": "2026-05-23T18:27:56.661Z",
      "x_nadsec_ports": [
        "1433",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=55933; asn_org=Cloudie Limited; user(top)=**",
      "id": "indicator--ba27dac5-5c81-4177-a132-ca734d1b777e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.115.50.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 436,
      "x_nadsec_first_seen": "2026-05-04T06:42:17.992Z",
      "x_nadsec_last_seen": "2026-05-16T13:47:42.919Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "55933"
      ],
      "x_nadsec_orgs": [
        "Cloudie Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "!**********c",
        "1******X",
        "P******d",
        "***"
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=457; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--035ec22c-2e6e-4db9-bd49-b6b9639f73e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.241.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 457,
      "x_nadsec_first_seen": "2026-05-04T06:41:54.018Z",
      "x_nadsec_last_seen": "2026-05-04T06:52:55.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=460; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7f632eb2-f464-40be-9776-2b7068c7c920",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.73.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 460,
      "x_nadsec_first_seen": "2026-05-04T06:41:53.672Z",
      "x_nadsec_last_seen": "2026-05-04T06:52:55.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--61b96cc8-1a20-48ae-bfff-06508e686f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.95.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T07:02:44.957Z",
      "x_nadsec_last_seen": "2026-05-04T07:02:44.957Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4c61c53f-d00a-4276-8755-e9cf1723fd0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.44.6.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T06:07:53.451Z",
      "x_nadsec_last_seen": "2026-05-04T06:07:53.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--235e044d-147f-495b-941a-31aaf73bccb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.127.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T06:40:44.660Z",
      "x_nadsec_last_seen": "2026-05-04T06:40:44.660Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--893e74eb-35a2-4f33-8c73-12ebe4197d19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T06:27:29.067Z",
      "x_nadsec_last_seen": "2026-05-10T19:43:22.844Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--5b5e6363-3bdb-435a-89da-6a2177cca59d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.54.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T07:01:11.831Z",
      "x_nadsec_last_seen": "2026-05-04T07:01:35.592Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-04T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--730ebfa2-bfc7-426b-8e2e-0aeada8efaec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.6.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T07:05:09.000Z",
      "valid_until": "2026-06-05T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T07:02:52.521Z",
      "x_nadsec_last_seen": "2026-05-04T08:26:01.412Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=23893; asn_org=Bangla Phone Ltd; user(top)=**",
      "id": "indicator--703cbe1d-3d51-427a-965e-4cd111da2d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.210.128.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:05:09.000Z",
      "valid_until": "2026-06-05T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T08:00:08.773Z",
      "x_nadsec_last_seen": "2026-05-16T01:51:06.381Z",
      "x_nadsec_ports": [
        "1433",
        "445"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23893"
      ],
      "x_nadsec_orgs": [
        "Bangla Phone Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--d616489e-d714-40ad-a552-abbad76c0a27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:05:09.000Z",
      "valid_until": "2026-06-05T08:05:08.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-05-04T07:29:43.450Z",
      "x_nadsec_last_seen": "2026-05-28T09:10:40.258Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "213790"
      ],
      "x_nadsec_orgs": [
        "Limited Network LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KR; asn=3786; asn_org=LG DACOM Corporation; user(top)=**",
      "id": "indicator--7c260ca0-54a5-4239-8f91-ed1fffcdada8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.180.247.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:05:09.000Z",
      "valid_until": "2026-06-05T08:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T07:42:11.633Z",
      "x_nadsec_last_seen": "2026-05-04T16:23:53.878Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "3786"
      ],
      "x_nadsec_orgs": [
        "LG DACOM Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5d711ad2-d6aa-49c6-affa-8bc4e3a11505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:05:09.000Z",
      "valid_until": "2026-06-05T08:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T07:05:38.096Z",
      "x_nadsec_last_seen": "2026-05-23T01:37:54.070Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=138746; asn_org=Live Fibernet",
      "id": "indicator--75c410b8-ffce-44b0-8bbb-56992b4474d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.125.155.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T08:19:49.174Z",
      "x_nadsec_last_seen": "2026-05-29T10:47:47.736Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138746"
      ],
      "x_nadsec_orgs": [
        "Live Fibernet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=58461; asn_org=CT-HangZhou-IDC",
      "id": "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.231.78.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-05-04T08:22:25.236Z",
      "x_nadsec_last_seen": "2026-05-30T13:14:26.409Z",
      "x_nadsec_ports": [
        "1433",
        "81",
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "httpd",
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58461"
      ],
      "x_nadsec_orgs": [
        "CT-HangZhou-IDC"
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ab5e27f1-4aa7-4fb3-9a7e-81595921166f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.118.30.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T08:50:39.193Z",
      "x_nadsec_last_seen": "2026-05-04T08:57:31.638Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2b762749-c644-40d9-b162-e8b9faeab119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.6.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T08:25:59.964Z",
      "x_nadsec_last_seen": "2026-05-04T08:25:59.964Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=RU; asn=12714; asn_org=PJSC MegaFon; user(top)=**; pass(top)=1**4",
      "id": "indicator--635e3a71-2c1d-44ee-9905-6411648494a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.106.134.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-04T09:02:50.717Z",
      "x_nadsec_last_seen": "2026-05-04T09:03:01.046Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12714"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4"
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--2d2b36a5-1750-46d1-b6e8-a6840da3b053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.10.100.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T08:07:29.328Z",
      "x_nadsec_last_seen": "2026-05-04T08:09:34.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--bb036ec5-3466-4dae-9baa-d062ca174578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.137.4.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T08:54:54.397Z",
      "x_nadsec_last_seen": "2026-05-04T09:01:24.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=21299; asn_org=Kar-Tel LLC",
      "id": "indicator--beb3c89a-40aa-425d-b77b-c932585f5d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.34.126.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T08:56:50.351Z",
      "x_nadsec_last_seen": "2026-05-04T08:56:50.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d12d9ff9-3630-45a6-8043-e9034fc29218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T08:42:06.936Z",
      "x_nadsec_last_seen": "2026-05-04T08:42:06.936Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--491ce209-92f4-4ca2-90cc-05e03bfc22c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.129.237.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:05:11.000Z",
      "valid_until": "2026-06-05T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T08:42:18.600Z",
      "x_nadsec_last_seen": "2026-05-09T08:46:26.759Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--55ba95f9-ad62-480d-adb5-aa963f4f2cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.49.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:05:10.000Z",
      "valid_until": "2026-06-05T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T09:09:28.144Z",
      "x_nadsec_last_seen": "2026-05-13T06:22:40.571Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--ff23ddcf-86de-42bf-99f8-a0000f4fbf54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.247.245.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:05:10.000Z",
      "valid_until": "2026-06-05T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T09:42:58.023Z",
      "x_nadsec_last_seen": "2026-05-04T09:45:07.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-05-04T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--842c0a2c-f0cf-4c2d-ae4d-8b5367580a1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.50.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:05:10.000Z",
      "valid_until": "2026-06-05T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T09:09:29.958Z",
      "x_nadsec_last_seen": "2026-05-04T09:09:29.958Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--03162b09-9cdc-4a44-9c10-c5396bd611f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.187.103.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:05:10.000Z",
      "valid_until": "2026-06-05T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T09:09:29.300Z",
      "x_nadsec_last_seen": "2026-05-04T09:09:29.300Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=epmapper; ports=135; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--59d60707-7782-4499-9ab3-854296f1e954",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.36.97.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:05:09.000Z",
      "valid_until": "2026-06-05T11:05:08.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-04T10:15:31.166Z",
      "x_nadsec_last_seen": "2026-05-04T10:36:35.073Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=21; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--d3e6338e-f0be-4b91-b21e-3e348c498769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:05:09.000Z",
      "valid_until": "2026-06-05T11:05:08.000Z",
      "x_nadsec_event_count": 168,
      "x_nadsec_first_seen": "2026-05-04T10:36:06.686Z",
      "x_nadsec_last_seen": "2026-05-29T04:11:10.760Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-04T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=LT; asn=47583; asn_org=Hostinger International Limited",
      "id": "indicator--9162602d-3d24-4d4a-9ab2-a96d16b8ab06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.97.187.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:05:09.000Z",
      "valid_until": "2026-06-05T11:05:08.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-05-04T10:35:32.818Z",
      "x_nadsec_last_seen": "2026-05-04T10:40:29.037Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "47583"
      ],
      "x_nadsec_orgs": [
        "Hostinger International Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "s****a"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--f7c17cc7-d8e6-4a3b-832b-4e8e704efd4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.22.140.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:05:09.000Z",
      "valid_until": "2026-06-05T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T10:20:24.215Z",
      "x_nadsec_last_seen": "2026-05-05T08:25:36.878Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-04T11:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a513abf8-89d8-49cf-988e-cbed1afa1f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T11:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.146.90.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:05:09.000Z",
      "valid_until": "2026-06-05T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T10:54:24.795Z",
      "x_nadsec_last_seen": "2026-05-04T10:54:35.178Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--68b4317a-598e-4117-ba81-75a9e70f48c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.14.89.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:05:10.000Z",
      "valid_until": "2026-06-05T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T11:06:25.375Z",
      "x_nadsec_last_seen": "2026-05-04T11:06:25.375Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5e83d553-6c92-4bc5-bb40-1ac4e69f5a65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.76.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:05:10.000Z",
      "valid_until": "2026-06-05T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T11:16:34.638Z",
      "x_nadsec_last_seen": "2026-05-04T11:16:44.815Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--efe55801-d519-4eeb-98d8-6aac4a1ff224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:05:10.000Z",
      "valid_until": "2026-06-05T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T11:12:35.915Z",
      "x_nadsec_last_seen": "2026-05-04T11:12:35.915Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--4eb411dc-e8a0-46e3-9208-27abdc9244ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:05:04.000Z",
      "valid_until": "2026-06-05T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T12:26:23.578Z",
      "x_nadsec_last_seen": "2026-05-08T15:35:38.671Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-04T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:05:04.000Z",
      "valid_until": "2026-06-05T13:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T13:03:25.671Z",
      "x_nadsec_last_seen": "2026-05-29T14:55:22.661Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-04T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c7e00175-22ca-4aa7-8d36-188087856731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.105.69.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:05:04.000Z",
      "valid_until": "2026-06-05T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T12:33:37.380Z",
      "x_nadsec_last_seen": "2026-05-04T12:35:44.028Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-04T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--051a3fe8-db38-487b-86af-c46c311daecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '9.234.8.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:05:04.000Z",
      "valid_until": "2026-06-05T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T12:07:03.143Z",
      "x_nadsec_last_seen": "2026-05-04T12:07:03.143Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--77866f86-b553-4864-9d8e-caa1f1848b10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.26.50.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:05:10.000Z",
      "valid_until": "2026-06-05T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T13:08:47.247Z",
      "x_nadsec_last_seen": "2026-05-09T05:11:32.607Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:05:10.000Z",
      "valid_until": "2026-06-05T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T13:26:59.228Z",
      "x_nadsec_last_seen": "2026-05-25T05:00:52.373Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:05:10.000Z",
      "valid_until": "2026-06-05T14:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-04T13:57:27.431Z",
      "x_nadsec_last_seen": "2026-05-21T05:50:48.523Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6b9296e7-5daf-42f9-a48c-543f090fc5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:05:10.000Z",
      "valid_until": "2026-06-05T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T13:16:40.419Z",
      "x_nadsec_last_seen": "2026-05-07T10:08:41.758Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--25b16f2c-5843-4394-b415-dc751882dbd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:05:10.000Z",
      "valid_until": "2026-06-05T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T13:44:53.740Z",
      "x_nadsec_last_seen": "2026-05-04T13:44:53.740Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d2bdfe10-5b54-4b91-8101-2269c4f36a1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.177.112.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T14:15:10.826Z",
      "x_nadsec_last_seen": "2026-05-04T14:15:11.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--55800b96-b538-4029-b919-408a25566b20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.27.163.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T14:25:43.656Z",
      "x_nadsec_last_seen": "2026-05-04T14:27:48.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2af86355-44f9-4f83-a1f6-071adb14daa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.181.98.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T14:58:35.073Z",
      "x_nadsec_last_seen": "2026-05-04T14:58:35.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--4a2cd920-1a69-4bfd-a903-8cf7ad6afd76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.58.118.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-04T14:44:09.041Z",
      "x_nadsec_last_seen": "2026-05-04T14:45:04.118Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1ea686b6-cc66-45df-b2ab-c03ccf867768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T14:42:18.346Z",
      "x_nadsec_last_seen": "2026-05-04T14:42:19.023Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ffb3bac5-32ca-434b-84fa-46600d3e3106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.228.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T14:43:08.321Z",
      "x_nadsec_last_seen": "2026-05-04T14:43:08.321Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--fdc86e46-5170-492c-a4f4-126144b135c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.77.225.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T14:06:31.246Z",
      "x_nadsec_last_seen": "2026-05-04T14:06:31.246Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.68.207.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 253,
      "x_nadsec_first_seen": "2026-05-04T15:01:51.720Z",
      "x_nadsec_last_seen": "2026-05-30T15:13:42.027Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "1433",
        "1723",
        "27017",
        "1883",
        "33071",
        "33145",
        "33333",
        "33593"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mssqld",
        "pptpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T14:21:35.902Z",
      "x_nadsec_last_seen": "2026-05-27T14:15:59.648Z",
      "x_nadsec_ports": [
        "1723",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2c241a12-956e-455a-810b-134cd0e9fc81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T14:10:02.809Z",
      "x_nadsec_last_seen": "2026-05-09T09:16:33.350Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--081cf61c-8a6c-42cf-b500-ecc3c6d20b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T14:36:09.461Z",
      "x_nadsec_last_seen": "2026-05-15T20:10:30.827Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:05:09.000Z",
      "valid_until": "2026-06-05T15:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T14:38:58.573Z",
      "x_nadsec_last_seen": "2026-05-19T12:38:59.054Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-04T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5fce842f-4ea4-42ad-b34c-15ecdb57e9a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.243.173.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:05:10.000Z",
      "valid_until": "2026-06-05T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T15:33:38.848Z",
      "x_nadsec_last_seen": "2026-05-04T15:33:38.848Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-04T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:05:10.000Z",
      "valid_until": "2026-06-05T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T15:11:22.293Z",
      "x_nadsec_last_seen": "2026-05-29T14:22:31.632Z",
      "x_nadsec_ports": [
        "1883",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-04T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2243b288-c1df-4558-bf89-cfd48c1879ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:05:10.000Z",
      "valid_until": "2026-06-05T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T15:50:33.713Z",
      "x_nadsec_last_seen": "2026-05-27T02:35:01.175Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--92eebc11-ef87-426b-bdc0-f101cda1d4d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.200.162.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:05:10.000Z",
      "valid_until": "2026-06-05T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T15:50:47.516Z",
      "x_nadsec_last_seen": "2026-05-04T15:52:53.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-05-04T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f41b67e4-0775-4284-97c8-dd16a90826c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:05:10.000Z",
      "valid_until": "2026-06-05T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T16:02:16.823Z",
      "x_nadsec_last_seen": "2026-05-04T16:02:17.542Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-04T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--a78b365c-a69a-4e0b-a08a-30877d2d5def",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '50.116.17.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:05:10.000Z",
      "valid_until": "2026-06-05T16:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-04T15:35:25.493Z",
      "x_nadsec_last_seen": "2026-05-04T15:36:20.599Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8fd4d7df-d123-4912-b473-48993f143449",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.46.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:05:10.000Z",
      "valid_until": "2026-06-05T17:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-04T16:17:42.059Z",
      "x_nadsec_last_seen": "2026-05-04T16:18:22.059Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--3a2d19df-db79-4e99-b879-0f0a0acbd5d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.146.70.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:05:10.000Z",
      "valid_until": "2026-06-05T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T16:32:26.101Z",
      "x_nadsec_last_seen": "2026-05-04T16:32:26.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:05:10.000Z",
      "valid_until": "2026-06-05T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T17:00:06.248Z",
      "x_nadsec_last_seen": "2026-05-04T17:00:06.248Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--7f5db671-bb45-4a52-be31-98fb8d355bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.99.186.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:05:10.000Z",
      "valid_until": "2026-06-05T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T16:32:07.721Z",
      "x_nadsec_last_seen": "2026-05-04T16:39:36.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-04T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8378a1c3-ac1e-4332-8a6b-d3609f44404b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:05:10.000Z",
      "valid_until": "2026-06-05T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T16:22:33.707Z",
      "x_nadsec_last_seen": "2026-05-24T11:03:50.853Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--de72fba4-97d9-49dd-b2b8-edd6cf8d4289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.58.207.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:05:10.000Z",
      "valid_until": "2026-06-05T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T17:53:09.673Z",
      "x_nadsec_last_seen": "2026-05-27T17:56:50.283Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--80275814-4565-43b8-96ed-07ee48e58be8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.119.86.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:05:10.000Z",
      "valid_until": "2026-06-05T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T17:51:39.459Z",
      "x_nadsec_last_seen": "2026-05-04T17:51:39.541Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-05-04T19:07:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9f723794-98a4-4c92-a62e-88e321430ace",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:07:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.58.207.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:07:48.000Z",
      "valid_until": "2026-06-05T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T18:12:31.213Z",
      "x_nadsec_last_seen": "2026-05-04T18:12:55.406Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T19:07:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mqttd; ports=1883; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--fde2da7c-7a18-4eee-bfb4-5434249f1534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:07:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.173.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:07:48.000Z",
      "valid_until": "2026-06-05T19:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T18:38:19.555Z",
      "x_nadsec_last_seen": "2026-05-04T18:39:30.716Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T19:07:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c573dbb6-1da6-4054-b1ea-aa2ae1ed595a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:07:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:07:48.000Z",
      "valid_until": "2026-06-05T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T18:45:01.890Z",
      "x_nadsec_last_seen": "2026-05-04T18:45:21.273Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T19:07:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=60721; asn_org=Bursabil Teknoloji A.S.; user(top)=**",
      "id": "indicator--012a5f04-576e-4a3e-8e5d-bdcce8201678",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:07:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.162.144.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:07:48.000Z",
      "valid_until": "2026-06-05T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T18:51:06.829Z",
      "x_nadsec_last_seen": "2026-05-23T09:58:13.460Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "60721"
      ],
      "x_nadsec_orgs": [
        "Bursabil Teknoloji A.S."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T19:07:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T19:07:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:07:48.000Z",
      "valid_until": "2026-06-05T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T18:51:21.746Z",
      "x_nadsec_last_seen": "2026-05-04T18:51:21.746Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cccbcd53-3e90-41c5-9523-0225d6dfbc3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:05:10.000Z",
      "valid_until": "2026-06-05T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T19:32:52.777Z",
      "x_nadsec_last_seen": "2026-05-04T19:32:52.777Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--12a745cb-ad2e-421e-90d7-0e7c555ce761",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:05:10.000Z",
      "valid_until": "2026-06-05T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T19:33:14.730Z",
      "x_nadsec_last_seen": "2026-05-04T19:33:14.730Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-04T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--53547410-363b-41de-bbeb-16c9bff088bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:05:10.000Z",
      "valid_until": "2026-06-05T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T19:13:29.002Z",
      "x_nadsec_last_seen": "2026-05-04T19:13:29.002Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d0b612a9-a934-4a11-baa3-ba071b3c0510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:05:10.000Z",
      "valid_until": "2026-06-05T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T19:13:22.987Z",
      "x_nadsec_last_seen": "2026-05-17T05:37:16.754Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cc12b759-db95-42dd-98bf-14110f391246",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:05:10.000Z",
      "valid_until": "2026-06-05T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T19:26:12.658Z",
      "x_nadsec_last_seen": "2026-05-04T19:26:12.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-04T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8983a4a0-54a7-4fb1-a51f-04504dfc8c8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:05:10.000Z",
      "valid_until": "2026-06-05T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T19:26:12.097Z",
      "x_nadsec_last_seen": "2026-05-09T17:16:42.742Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-04T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--267a773a-095d-42d3-b5fd-ce0a9e5a1e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.134.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:05:09.000Z",
      "valid_until": "2026-06-05T21:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-04T20:28:44.196Z",
      "x_nadsec_last_seen": "2026-05-04T20:29:04.062Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:05:09.000Z",
      "valid_until": "2026-06-05T21:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T20:10:36.887Z",
      "x_nadsec_last_seen": "2026-05-04T20:10:37.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0253b16c-fac2-4294-88a5-5447fb52a140",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:05:09.000Z",
      "valid_until": "2026-06-05T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T20:57:28.761Z",
      "x_nadsec_last_seen": "2026-05-04T20:57:28.761Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--523f21f4-fa64-4a26-a7ab-ae3146303539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.150.101.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-04T21:48:47.120Z",
      "x_nadsec_last_seen": "2026-05-04T21:50:52.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--0b2900fd-1315-4ac3-9cfc-612940a3875f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.93.250.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:40:45.087Z",
      "x_nadsec_last_seen": "2026-05-04T21:40:45.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**; pass(top)=***",
      "id": "indicator--334a5931-0c5c-44c6-996a-a799c8daf5b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.148.225.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:57:59.651Z",
      "x_nadsec_last_seen": "2026-05-04T21:57:59.651Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--ef65348f-535b-4db2-afcd-b81db3294a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.178.129.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:58:03.349Z",
      "x_nadsec_last_seen": "2026-05-04T21:58:03.349Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--7ef768e5-5bed-46f6-9740-fe431cff8cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.160.232.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:57:55.506Z",
      "x_nadsec_last_seen": "2026-05-04T21:57:55.506Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b38e95b1-e67a-4a02-a214-0524b8728f4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.178.210.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:58:11.395Z",
      "x_nadsec_last_seen": "2026-05-04T21:58:11.395Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--092b3c4a-e8d1-493f-aefa-4ca3991ecba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.123.77.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:58:19.354Z",
      "x_nadsec_last_seen": "2026-05-04T21:58:19.354Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a06d57a3-6d69-47db-8d9c-2a46d5bc8192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T21:27:37.863Z",
      "x_nadsec_last_seen": "2026-05-08T01:57:03.215Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--b8e9a6e6-955a-4882-9ff4-e4917c79acc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.197.97.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:57:47.240Z",
      "x_nadsec_last_seen": "2026-05-04T21:57:47.240Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--ccba7059-ad95-475a-a12a-48d1e75a1dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.207.35.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T21:57:45.835Z",
      "x_nadsec_last_seen": "2026-05-04T21:57:45.835Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=56046; asn_org=China Mobile communications corporation; user(top)=**; pass(top)=***",
      "id": "indicator--e0df549b-603f-4ade-b71d-32026392849b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.156.145.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T21:34:46.846Z",
      "x_nadsec_last_seen": "2026-05-06T05:00:48.697Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56046"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**; pass(top)=***",
      "id": "indicator--eca660fe-5330-436c-a53d-72faf7707940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.8.224.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T21:39:21.540Z",
      "x_nadsec_last_seen": "2026-05-04T21:39:22.135Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--e61e7c3e-3b31-4f4f-aef7-607b118ad8f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.60.42.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-04T21:50:41.187Z",
      "x_nadsec_last_seen": "2026-05-04T21:54:23.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-05-04T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--4d2b306b-24f7-4d70-a730-13120db63d1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.105.136.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:05:10.000Z",
      "valid_until": "2026-06-05T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T21:52:16.699Z",
      "x_nadsec_last_seen": "2026-05-30T19:13:24.930Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=263422; asn_org=AXES SERVICOS DE COMUNICACAO LTDA.; user(top)=**",
      "id": "indicator--67cbf654-8ac3-4bf0-a194-c6a0236ce9d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.191.237.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:05:10.000Z",
      "valid_until": "2026-06-05T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-04T22:48:28.676Z",
      "x_nadsec_last_seen": "2026-05-04T22:48:28.676Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263422"
      ],
      "x_nadsec_orgs": [
        "AXES SERVICOS DE COMUNICACAO LTDA."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=5573; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--b0883da9-23b2-4bde-84c9-ef9a1a4fe331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.112.228.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:05:10.000Z",
      "valid_until": "2026-06-05T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T22:31:00.314Z",
      "x_nadsec_last_seen": "2026-05-28T06:55:02.853Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "5573"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--7780fc15-a51c-40c0-ace9-1954362a4ba3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.189.249.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:05:10.000Z",
      "valid_until": "2026-06-05T23:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-04T22:09:58.939Z",
      "x_nadsec_last_seen": "2026-05-05T05:00:24.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-04T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e45148c0-95d2-432a-a43a-938d5c89e308",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.101.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:05:10.000Z",
      "valid_until": "2026-06-05T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-04T22:27:56.915Z",
      "x_nadsec_last_seen": "2026-05-04T22:28:39.752Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-04T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:05:10.000Z",
      "valid_until": "2026-06-05T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T22:58:19.506Z",
      "x_nadsec_last_seen": "2026-05-12T14:10:45.422Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-04T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--29cf73a4-b3cf-4936-b5e1-a1e068a31328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.221.207.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:05:10.000Z",
      "valid_until": "2026-06-05T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-04T22:36:25.668Z",
      "x_nadsec_last_seen": "2026-05-13T06:55:53.768Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-04T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6732c885-62a4-4ee1-916f-9ff27e35f687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-04T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:05:10.000Z",
      "valid_until": "2026-06-05T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-04T22:51:41.206Z",
      "x_nadsec_last_seen": "2026-05-25T10:37:37.356Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--88f30cb2-5890-4706-a057-deb56fba9d39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.71.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:05:10.000Z",
      "valid_until": "2026-06-06T00:05:09.000Z",
      "x_nadsec_event_count": 3023,
      "x_nadsec_first_seen": "2026-05-04T23:31:59.708Z",
      "x_nadsec_last_seen": "2026-05-05T00:46:28.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-05T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IQ; asn=206206; asn_org=Kurdistan Net Company for Computer and Internet Ltd.; user(top)=**",
      "id": "indicator--7344e890-d989-4542-9325-c1ec420ff437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.136.151.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:05:10.000Z",
      "valid_until": "2026-06-06T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-04T23:41:19.061Z",
      "x_nadsec_last_seen": "2026-05-15T21:22:58.118Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "206206"
      ],
      "x_nadsec_orgs": [
        "Kurdistan Net Company for Computer and Internet Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--6b7426b1-b923-4cca-981e-2e206094c2d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.144.23.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:05:10.000Z",
      "valid_until": "2026-06-06T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T00:57:48.987Z",
      "x_nadsec_last_seen": "2026-05-11T00:59:33.704Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-05T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--267bbacd-1def-4b4c-97c3-a5cce3fa4333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:05:10.000Z",
      "valid_until": "2026-06-06T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T00:25:01.268Z",
      "x_nadsec_last_seen": "2026-05-05T00:25:38.560Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--3f26ffde-cb04-468e-aa3f-55141b864b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T01:05:10.000Z",
      "valid_until": "2026-06-06T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T00:57:54.426Z",
      "x_nadsec_last_seen": "2026-05-05T00:57:54.426Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-05T02:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--c2a53c02-d943-4f1d-ac7d-15d76da1428a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.219.89.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:05:27.000Z",
      "valid_until": "2026-06-06T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T02:00:09.630Z",
      "x_nadsec_last_seen": "2026-05-05T02:02:14.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-05T02:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=202870; asn_org=Dimensione S.r.l.",
      "id": "indicator--aabe07d6-fe27-4d1d-88b1-a7f12ed7ac5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.32.124.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:05:27.000Z",
      "valid_until": "2026-06-06T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T01:11:42.507Z",
      "x_nadsec_last_seen": "2026-05-05T01:16:44.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "202870"
      ],
      "x_nadsec_orgs": [
        "Dimensione S.r.l."
      ]
    },
    {
      "created": "2026-05-05T02:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--ccfbcdaa-4405-41c4-a453-d90161eda084",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.14.49.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:05:27.000Z",
      "valid_until": "2026-06-06T02:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-05T01:46:25.581Z",
      "x_nadsec_last_seen": "2026-05-20T00:16:55.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-05-05T02:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--52c8643a-bd1c-4ea8-bd12-6be513c27f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T02:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.116.117.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:05:27.000Z",
      "valid_until": "2026-06-06T02:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T01:14:10.520Z",
      "x_nadsec_last_seen": "2026-05-21T01:08:52.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--8e1cfcd5-7ae1-4fd6-8700-4c444a099855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.177.241.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:05:10.000Z",
      "valid_until": "2026-06-06T03:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T02:09:03.806Z",
      "x_nadsec_last_seen": "2026-05-09T20:14:06.743Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--54b368b7-6a92-48cd-a6f9-d7ada7806f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T03:08:25.788Z",
      "x_nadsec_last_seen": "2026-05-17T21:42:17.246Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--b1b06d77-a010-409c-a80d-702af7f0216e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T03:47:49.637Z",
      "x_nadsec_last_seen": "2026-05-05T03:48:08.051Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--fa7d2886-e9b0-454d-ba52-fb59a71139a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T03:47:37.680Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:07.199Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--d863abbb-dc26-4d72-8487-953c4d9a99b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:34.474Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:47.979Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--9fe949a1-79ba-4ad8-bf32-7d0a22d502e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:55.938Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:11.732Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--b651b6c4-d125-4e88-a577-8e998d259af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:51.321Z",
      "x_nadsec_last_seen": "2026-05-05T03:48:01.649Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--bdec3ae6-ce40-4cb0-8824-190052e251fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:47:58.399Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:58.399Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--108203b8-d5a7-48ed-9ed2-1810d271c718",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T03:47:39.229Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:04.227Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--b53473f1-e798-42d1-abd8-924e04b1b98c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:47:36.069Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:36.069Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--76fb42b3-7eb3-41e8-841c-c14c39ab44d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:35.273Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:57.499Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--7f8f2bae-859e-4199-99d9-aef2014511d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-05T03:47:50.504Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:13.219Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--42804fc7-2562-4585-a8ba-4e6f983ec324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:47:43.270Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:43.270Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--e69b6cf6-96d9-43d1-b5f8-5e80e0cc464f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:48:00.019Z",
      "x_nadsec_last_seen": "2026-05-05T03:48:00.019Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--8894bdcc-5bbc-4fab-8ef0-7bcd8eab697a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:47:38.481Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:38.481Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--556a9ae7-99bc-453e-acb8-72d4a1561188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:47:45.663Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:45.663Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--e8dd2f5b-46a7-4f84-8517-4f6fd5477c4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:36.914Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:48.527Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--01750c65-bf1f-4d0e-a68c-c9d92ce0af5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T03:47:44.037Z",
      "x_nadsec_last_seen": "2026-05-05T03:48:04.049Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--562b96a3-5f42-414d-a73d-b7dca7a7a950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:40.891Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:55.110Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--7e8ddc6d-ee15-4a8c-8f80-a877990c0279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:48:00.794Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:03.477Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--dd47b6a0-2a37-48cb-89f1-d53f95efeb59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:41.744Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:00.487Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--b4de338a-860e-47b2-b529-39bdc028112e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:47:57.648Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:57.648Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--0019fe01-03d4-422b-ba83-14e0f10b0bb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:42.497Z",
      "x_nadsec_last_seen": "2026-05-05T03:48:03.286Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--87fa00e9-90ff-4f1e-a987-2b583ec0d108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:47:46.453Z",
      "x_nadsec_last_seen": "2026-05-05T03:47:46.453Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--2907082e-375c-43ec-806e-02486d9e50ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:48:06.398Z",
      "x_nadsec_last_seen": "2026-05-05T03:48:06.398Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--735ccbd5-1214-4bce-8953-fdfa3a290e6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T03:47:40.048Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:53.768Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--4da16b23-a050-4526-8d7b-6c6da08ce202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T03:47:44.852Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:58.244Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--36afb7da-5833-4a6a-8edf-b24fbdc03e1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.71.180.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T03:12:37.462Z",
      "x_nadsec_last_seen": "2026-05-21T11:37:13.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--e09fa7cf-c404-4c30-84c3-0bb61e7aef37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.95.86.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:22:53.723Z",
      "x_nadsec_last_seen": "2026-05-05T03:22:53.723Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T03:06:32.462Z",
      "x_nadsec_last_seen": "2026-05-05T03:06:32.462Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-05T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=20485; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--49bf36be-cc7a-4346-8d79-28c0a0efbb2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.234.207.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:05:04.000Z",
      "valid_until": "2026-06-06T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T03:17:59.541Z",
      "x_nadsec_last_seen": "2026-05-05T03:20:06.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "20485"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-05-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cb974137-615d-4f1b-bfbc-df376c0e17b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:05:10.000Z",
      "valid_until": "2026-06-06T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T04:56:23.798Z",
      "x_nadsec_last_seen": "2026-05-05T04:56:33.971Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--7a9376d2-59b7-44f4-b69a-5d5a3f769062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.145.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:05:10.000Z",
      "valid_until": "2026-06-06T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T04:44:05.137Z",
      "x_nadsec_last_seen": "2026-05-05T04:46:10.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--476123b0-727d-411b-ae11-feaf2b68ae73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:05:10.000Z",
      "valid_until": "2026-06-06T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T04:35:27.292Z",
      "x_nadsec_last_seen": "2026-05-05T04:35:27.292Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--43e9eae1-91c5-40ba-9e54-3a1cf284e899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.186.26.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:05:10.000Z",
      "valid_until": "2026-06-06T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T04:31:28.124Z",
      "x_nadsec_last_seen": "2026-05-05T04:31:28.124Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--854fc60e-8476-47fc-8f39-74d3fe1369a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.45.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:05:10.000Z",
      "valid_until": "2026-06-06T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T04:42:31.516Z",
      "x_nadsec_last_seen": "2026-05-05T04:42:55.743Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-05T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fee0cf16-01e2-4c04-b4a1-6f0df9a06262",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.59.173.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:05:09.000Z",
      "valid_until": "2026-06-06T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T05:40:48.350Z",
      "x_nadsec_last_seen": "2026-05-05T05:40:48.350Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-05T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=4780; asn_org=Digital United Inc.",
      "id": "indicator--574bdb59-a8b9-4903-93b1-d0c2bf280f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.182.162.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:05:09.000Z",
      "valid_until": "2026-06-06T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T05:07:49.941Z",
      "x_nadsec_last_seen": "2026-05-05T05:09:55.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "4780"
      ],
      "x_nadsec_orgs": [
        "Digital United Inc."
      ]
    },
    {
      "created": "2026-05-05T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=7602; asn_org=Sai gon Postel Corporation; user(top)=**",
      "id": "indicator--4dbf2de2-9238-45fb-bf44-c5ccea93ead8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.133.9.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:05:09.000Z",
      "valid_until": "2026-06-06T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T05:19:42.399Z",
      "x_nadsec_last_seen": "2026-05-05T05:19:42.399Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7602"
      ],
      "x_nadsec_orgs": [
        "Sai gon Postel Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--183d1a2b-f451-4c4d-b26e-64e4b19b1468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:05:09.000Z",
      "valid_until": "2026-06-06T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T05:33:06.057Z",
      "x_nadsec_last_seen": "2026-05-06T22:31:00.813Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mysqld; ports=3306; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.195.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:05:09.000Z",
      "valid_until": "2026-06-06T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T05:17:49.354Z",
      "x_nadsec_last_seen": "2026-05-05T05:20:31.460Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--86185a1d-5fcd-4c49-886f-166b808bb805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.167.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T06:25:39.358Z",
      "x_nadsec_last_seen": "2026-05-05T06:32:45.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--89a6cabf-24f9-45b9-9a6d-503adf8f56d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.251.199.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-05T06:18:45.663Z",
      "x_nadsec_last_seen": "2026-05-15T14:13:58.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--5799d0ae-1497-47ff-afaf-bffe520daf2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.153.123.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-05T06:57:12.439Z",
      "x_nadsec_last_seen": "2026-05-29T13:46:35.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=335; services=smbd; ports=445; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd",
      "id": "indicator--18b94203-af2b-4fc5-9aff-4dfc5773222c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.79.60.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-05-05T06:55:37.323Z",
      "x_nadsec_last_seen": "2026-05-05T07:31:37.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ac59adf1-9a48-4e61-8946-be96ad55166e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T06:13:46.095Z",
      "x_nadsec_last_seen": "2026-05-29T04:25:02.672Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--36aff66c-644e-4830-b407-284f9e017b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T06:22:31.021Z",
      "x_nadsec_last_seen": "2026-05-05T06:22:31.021Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--ee360776-cbf9-4d0e-9ea0-16c36daa3a3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.159.24.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T06:52:07.146Z",
      "x_nadsec_last_seen": "2026-05-05T06:54:13.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e40335bc-d5ea-431b-8ad2-0b726a5bf78f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.68.94.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T07:03:45.490Z",
      "x_nadsec_last_seen": "2026-05-05T07:03:45.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2189; services=smbd; ports=445; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--b61a4f40-e529-4d6f-bfa4-5df74b609701",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.72.199.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 3152,
      "x_nadsec_first_seen": "2026-05-05T06:05:54.066Z",
      "x_nadsec_last_seen": "2026-05-05T07:25:49.897Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--eb5fc83b-44fa-45a2-9154-47bd7412911a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T06:24:22.211Z",
      "x_nadsec_last_seen": "2026-05-05T06:25:36.105Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--c77cd7a0-8100-4308-b625-7ee6f41a1f76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T06:24:06.392Z",
      "x_nadsec_last_seen": "2026-05-05T06:25:05.302Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--d2262fa7-e724-42b0-b000-7d19e199e561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T06:24:57.053Z",
      "x_nadsec_last_seen": "2026-05-05T06:25:25.579Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--933e7eb6-2106-4071-ae63-b13be35bd68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T06:24:05.491Z",
      "x_nadsec_last_seen": "2026-05-05T06:25:20.579Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-05T07:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T07:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:05:04.000Z",
      "valid_until": "2026-06-06T07:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T06:32:25.059Z",
      "x_nadsec_last_seen": "2026-05-20T18:31:55.708Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=146936; asn_org=SARASWATI INTERNET SOLUTION; user(top)=**",
      "id": "indicator--b4c8499f-098f-4aec-a30d-ad0770401dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.172.48.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T07:13:08.058Z",
      "x_nadsec_last_seen": "2026-05-05T07:13:08.058Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "146936"
      ],
      "x_nadsec_orgs": [
        "SARASWATI INTERNET SOLUTION"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=134861; asn_org=BroadStar Net India Pvt.Ltd.",
      "id": "indicator--cab73685-1149-49ea-9d06-b05459390f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.205.112.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-05T07:41:47.692Z",
      "x_nadsec_last_seen": "2026-05-05T07:44:29.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134861"
      ],
      "x_nadsec_orgs": [
        "BroadStar Net India Pvt.Ltd."
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f0e755ac-c2b8-4d9f-98ef-996234fdff92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.199.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T07:26:51.333Z",
      "x_nadsec_last_seen": "2026-05-05T07:26:51.333Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--8efa281d-1970-4b97-a0ec-e940166b0d7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.8.182.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T07:12:33.609Z",
      "x_nadsec_last_seen": "2026-05-05T07:19:07.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--32107618-4db0-4cd8-89c6-8a951ba5cb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.121.46.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T07:08:49.127Z",
      "x_nadsec_last_seen": "2026-05-05T07:08:49.127Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6e137a90-c70a-4d00-8bc0-903e73578004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T07:25:50.139Z",
      "x_nadsec_last_seen": "2026-05-13T20:19:57.819Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--80ffbae1-1c20-453e-b850-f5d1e6d761db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.139.198.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T07:31:28.407Z",
      "x_nadsec_last_seen": "2026-05-05T07:33:35.568Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-05-05T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--16e4b43b-2f20-427b-9031-e527409eba19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.90.43.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:05:10.000Z",
      "valid_until": "2026-06-06T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T07:08:37.614Z",
      "x_nadsec_last_seen": "2026-05-05T07:08:37.614Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-05T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7b3190b5-8fd3-4205-aa47-d705e0c4d690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.184.144.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:05:09.000Z",
      "valid_until": "2026-06-06T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T08:18:20.257Z",
      "x_nadsec_last_seen": "2026-05-05T08:20:26.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-05T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BR; asn=264377; asn_org=FV TECNOLOGIA DA INFORMACAO LTDA ME",
      "id": "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '131.161.123.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:05:09.000Z",
      "valid_until": "2026-06-06T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T09:04:02.582Z",
      "x_nadsec_last_seen": "2026-05-06T03:54:54.199Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264377"
      ],
      "x_nadsec_orgs": [
        "FV TECNOLOGIA DA INFORMACAO LTDA ME"
      ]
    },
    {
      "created": "2026-05-05T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--6e80d481-9d93-4a1c-a630-0e9db926541a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.63.250.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:05:09.000Z",
      "valid_until": "2026-06-06T09:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T08:21:00.403Z",
      "x_nadsec_last_seen": "2026-05-06T11:19:59.891Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--0bc4cec3-6e04-4092-960c-7eec9005cb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.187.13.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:05:09.000Z",
      "valid_until": "2026-06-06T09:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-05T08:19:37.665Z",
      "x_nadsec_last_seen": "2026-05-20T03:17:25.205Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-05T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--cd655c1b-c6b6-45e7-b470-9798bb4542f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.211.22.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:05:09.000Z",
      "valid_until": "2026-06-06T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T08:34:27.477Z",
      "x_nadsec_last_seen": "2026-05-05T08:41:58.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-05T09:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc; user(top)=**; pass(top)=***",
      "id": "indicator--d1078245-1d83-43ba-97b1-1b6e82e6cf56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T09:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.98.77.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:05:09.000Z",
      "valid_until": "2026-06-06T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T08:10:15.231Z",
      "x_nadsec_last_seen": "2026-05-05T08:10:15.231Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-05T10:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f1372e31-9013-43f2-a30d-becdc04339dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.119.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:05:21.000Z",
      "valid_until": "2026-06-06T10:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T09:19:29.265Z",
      "x_nadsec_last_seen": "2026-05-05T09:19:29.265Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-05T10:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--23c0e314-9cbd-4f6b-890c-4f962e46bc35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.19.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:05:21.000Z",
      "valid_until": "2026-06-06T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T09:54:13.154Z",
      "x_nadsec_last_seen": "2026-05-05T09:56:20.745Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T10:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=12389; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--ca9c4987-51a2-4bfc-83ac-b2c299c2eaba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.128.73.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:05:21.000Z",
      "valid_until": "2026-06-06T10:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T09:10:43.239Z",
      "x_nadsec_last_seen": "2026-05-05T09:10:44.738Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T10:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf1982a2-68f5-4451-ac53-9b4898247edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.102.116.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:05:21.000Z",
      "valid_until": "2026-06-06T10:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T09:18:32.907Z",
      "x_nadsec_last_seen": "2026-05-05T09:18:43.118Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T10:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--32d39242-ab94-43f4-887b-ed37f15c88e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.207.244.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:05:21.000Z",
      "valid_until": "2026-06-06T10:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T09:13:49.955Z",
      "x_nadsec_last_seen": "2026-05-06T02:10:13.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-05T10:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f7921562-a9db-4916-9db5-f6d85004c318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.142.42.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:05:21.000Z",
      "valid_until": "2026-06-06T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T09:18:46.709Z",
      "x_nadsec_last_seen": "2026-05-05T09:23:06.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T10:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=RU; asn=62314; asn_org=Atmospherica Ltd.",
      "id": "indicator--b9a9b498-8651-42c4-8d6e-22483ad8c0ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T10:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.171.178.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:05:21.000Z",
      "valid_until": "2026-06-06T10:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T09:45:03.830Z",
      "x_nadsec_last_seen": "2026-05-05T09:45:25.724Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "62314"
      ],
      "x_nadsec_orgs": [
        "Atmospherica Ltd."
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--3daad0a4-ee9d-4fa0-9ed0-258a891ceed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.63.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T10:50:53.004Z",
      "x_nadsec_last_seen": "2026-05-05T10:53:00.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--3e074dcc-8266-4629-abae-971754e58a66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.68.126.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T10:56:51.423Z",
      "x_nadsec_last_seen": "2026-05-05T10:56:51.423Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=36914; asn_org=Kenya Education Network",
      "id": "indicator--9c2e5d1f-3ee0-4eef-891b-58d1fc6b852e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.136.50.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T10:13:25.191Z",
      "x_nadsec_last_seen": "2026-05-05T10:15:34.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36914"
      ],
      "x_nadsec_orgs": [
        "Kenya Education Network"
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dd293e37-6576-4e99-9d08-c5287ae73a35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T10:47:17.161Z",
      "x_nadsec_last_seen": "2026-05-05T10:47:17.479Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--3f333269-f9ee-4a69-b06f-2207f6d83390",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.216.234.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-05T10:18:05.596Z",
      "x_nadsec_last_seen": "2026-05-12T18:53:09.985Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--83512980-1927-4882-b837-4b704548a82c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.134.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T10:33:47.318Z",
      "x_nadsec_last_seen": "2026-05-05T10:33:47.318Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c3ce7385-b12e-47d9-8a18-23b77b482eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T10:33:03.648Z",
      "x_nadsec_last_seen": "2026-05-27T02:30:45.486Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T10:54:48.034Z",
      "x_nadsec_last_seen": "2026-05-16T04:59:02.517Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--a3e896ce-231f-47c5-9814-643979b06f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T10:39:12.495Z",
      "x_nadsec_last_seen": "2026-05-27T07:04:05.604Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-05T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:05:10.000Z",
      "valid_until": "2026-06-06T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T10:54:56.344Z",
      "x_nadsec_last_seen": "2026-05-13T23:32:44.162Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--77f29de8-e787-495e-a61c-7ce452a57e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:05:10.000Z",
      "valid_until": "2026-06-06T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T11:53:43.189Z",
      "x_nadsec_last_seen": "2026-05-05T11:53:43.189Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ebd17a42-6086-4a5b-a4e9-9eac96845c2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.42.2.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:05:10.000Z",
      "valid_until": "2026-06-06T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T11:55:21.728Z",
      "x_nadsec_last_seen": "2026-05-05T12:02:31.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:05:10.000Z",
      "valid_until": "2026-06-06T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T11:54:44.204Z",
      "x_nadsec_last_seen": "2026-05-28T14:17:08.224Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:05:10.000Z",
      "valid_until": "2026-06-06T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T11:07:31.734Z",
      "x_nadsec_last_seen": "2026-05-14T15:13:03.887Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--39b57656-b73b-4b51-81b7-5e1b6ef20327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.218.82.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:05:10.000Z",
      "valid_until": "2026-06-06T12:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T12:00:43.590Z",
      "x_nadsec_last_seen": "2026-05-18T22:05:50.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-05-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--63def225-818e-4c67-acda-89ab5b6d5c89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.97.42.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:05:10.000Z",
      "valid_until": "2026-06-06T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T11:06:12.039Z",
      "x_nadsec_last_seen": "2026-05-05T11:08:18.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-05T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=202293; asn_org=D-Cloud LLC",
      "id": "indicator--fa307cff-b768-4b41-a236-d356d4268967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.229.151.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:05:10.000Z",
      "valid_until": "2026-06-06T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T11:15:24.579Z",
      "x_nadsec_last_seen": "2026-05-05T11:17:32.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "202293"
      ],
      "x_nadsec_orgs": [
        "D-Cloud LLC"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--1cc12528-ce54-4fa4-9fde-7f0ac2ac72c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.227.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T12:16:08.602Z",
      "x_nadsec_last_seen": "2026-05-05T12:18:15.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=8075; asn_org=Microsoft Corporation; user(top)=**; pass(top)=1****6",
      "id": "indicator--c51a3fea-76f7-49c0-aa3d-1fff794e6077",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.40.41.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T12:31:58.818Z",
      "x_nadsec_last_seen": "2026-05-09T02:52:08.428Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=23956; asn_org=AmberIT Limited",
      "id": "indicator--01731537-9b88-4be2-baea-c6fa3f4f3ee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.4.107.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T12:26:17.313Z",
      "x_nadsec_last_seen": "2026-05-23T07:08:13.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23956"
      ],
      "x_nadsec_orgs": [
        "AmberIT Limited"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--dafb893f-c158-4170-a349-4253ab7a789c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.52.185.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T13:03:08.272Z",
      "x_nadsec_last_seen": "2026-05-05T13:03:08.272Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d2533351-c9a2-4280-9356-8d3520b37e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.76.35.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T12:28:20.854Z",
      "x_nadsec_last_seen": "2026-05-10T05:25:53.401Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--4b302297-6401-4e12-8d7e-c5500d5fb222",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.195.130.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T13:04:19.617Z",
      "x_nadsec_last_seen": "2026-05-05T13:05:01.809Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e1e6e3f8-e643-4a87-b715-35187adcf16c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.88.119.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T12:30:51.061Z",
      "x_nadsec_last_seen": "2026-05-13T21:52:40.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-05T13:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IE; asn=15502; asn_org=Vodafone Ireland Limited",
      "id": "indicator--ea252d1b-cea8-48c2-b003-d007d284de0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T13:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.19.79.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:05:15.000Z",
      "valid_until": "2026-06-06T13:05:14.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T12:16:33.863Z",
      "x_nadsec_last_seen": "2026-05-05T12:24:20.835Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "15502"
      ],
      "x_nadsec_orgs": [
        "Vodafone Ireland Limited"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--b4f06806-5556-46a6-bc3b-7113744145db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.99.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T14:02:18.902Z",
      "x_nadsec_last_seen": "2026-05-05T14:08:35.337Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--32564c07-3418-4663-a9c5-ccb99a1f7500",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.176.99.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-05T13:11:32.920Z",
      "x_nadsec_last_seen": "2026-05-23T19:54:21.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--ed5d2a42-8b60-488d-8c56-73a09ac5e601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.54.173.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-05-05T13:13:04.135Z",
      "x_nadsec_last_seen": "2026-05-18T22:28:07.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--41e564b0-91c6-47c3-b472-09516b07bcf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.177.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T13:36:08.106Z",
      "x_nadsec_last_seen": "2026-05-05T13:36:11.448Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ebe3f48a-5054-46d6-a44e-34579acd4abe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.46.158.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T13:50:42.841Z",
      "x_nadsec_last_seen": "2026-05-05T13:52:49.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=80; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--e83909fb-cc4e-4ac6-84bd-84ae9bf82ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 276,
      "x_nadsec_first_seen": "2026-05-05T13:38:12.153Z",
      "x_nadsec_last_seen": "2026-05-11T06:03:26.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--57604121-45a2-46c7-a4a4-24dce9715ff6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T13:53:46.115Z",
      "x_nadsec_last_seen": "2026-05-05T13:53:46.115Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--075a4a57-70da-47fe-9ef9-fd763948a028",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T13:53:45.856Z",
      "x_nadsec_last_seen": "2026-05-05T13:53:45.856Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--508c86fe-d0d4-429c-aef4-931a6911118e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.235.102.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-05T13:50:41.337Z",
      "x_nadsec_last_seen": "2026-05-18T20:59:50.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--c355e299-335c-41ee-a054-a70b5e70e7bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.235.102.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T13:57:07.272Z",
      "x_nadsec_last_seen": "2026-05-18T21:01:57.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-05T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:05:10.000Z",
      "valid_until": "2026-06-06T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T14:04:38.589Z",
      "x_nadsec_last_seen": "2026-05-17T14:18:28.640Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=198381; asn_org=Star Satellite Communications Company - PJSC",
      "id": "indicator--dcfc7eff-9f92-4e15-93bb-f22f4696c3ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.105.162.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T14:36:53.942Z",
      "x_nadsec_last_seen": "2026-05-05T14:37:00.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "198381"
      ],
      "x_nadsec_orgs": [
        "Star Satellite Communications Company - PJSC"
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=3326; asn_org=Private Joint Stock Company datagroup",
      "id": "indicator--1bb295e9-12c9-4fd9-872c-4ffa833c91c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.102.32.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T14:56:30.852Z",
      "x_nadsec_last_seen": "2026-05-05T15:03:40.512Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3326"
      ],
      "x_nadsec_orgs": [
        "Private Joint Stock Company datagroup"
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=10620; asn_org=Telmex Colombia S.A.",
      "id": "indicator--b4e53573-b96e-4dfb-aad4-dc2ec77eb6a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.62.56.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T14:12:46.259Z",
      "x_nadsec_last_seen": "2026-05-05T14:20:26.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "10620"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--5cf49f30-b480-4e30-ad7c-e3df116c9c65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T14:32:16.990Z",
      "x_nadsec_last_seen": "2026-05-05T14:32:16.990Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4a9041e0-3a44-476a-8370-2a323523bea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T15:00:07.880Z",
      "x_nadsec_last_seen": "2026-05-15T15:47:37.167Z",
      "x_nadsec_ports": [
        "3306",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--32b32c4a-a38d-4d21-a883-4b2f6bed6ccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.80.201.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T14:52:21.846Z",
      "x_nadsec_last_seen": "2026-05-05T14:52:32.165Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4e3ab079-946e-4db5-a9a0-61704b51706b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T14:33:57.346Z",
      "x_nadsec_last_seen": "2026-05-09T19:37:50.855Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-05T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=22773; asn_org=Cox Communications Inc.",
      "id": "indicator--b63bc71e-3277-4055-97c1-9d598405e72a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.191.195.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:05:11.000Z",
      "valid_until": "2026-06-06T15:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-05T14:47:24.607Z",
      "x_nadsec_last_seen": "2026-05-25T17:52:43.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22773"
      ],
      "x_nadsec_orgs": [
        "Cox Communications Inc."
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--08acf91c-c26f-4c00-9b61-e389ac125046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T15:18:26.184Z",
      "x_nadsec_last_seen": "2026-05-05T15:18:26.184Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--02b4da24-bfb9-47ec-aed2-656008d46523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T15:09:26.155Z",
      "x_nadsec_last_seen": "2026-05-13T01:15:32.494Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=48964; asn_org=Private Enterprise Enterra",
      "id": "indicator--36119191-66a5-4ba7-9117-a93a516a4f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.216.231.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-05-05T15:15:42.221Z",
      "x_nadsec_last_seen": "2026-05-30T15:28:43.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "48964"
      ],
      "x_nadsec_orgs": [
        "Private Enterprise Enterra"
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--70618f04-dcb8-4cfa-bf92-c9add9e99907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.74.214.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T15:47:38.241Z",
      "x_nadsec_last_seen": "2026-05-05T15:54:06.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--19a91643-038a-4380-884b-5b6f33c7a326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.203.212.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T15:09:25.497Z",
      "x_nadsec_last_seen": "2026-05-05T15:11:33.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd; user(top)=**",
      "id": "indicator--0b406edc-f69f-482e-b7c5-4f3873b0d937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.79.49.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T15:54:29.343Z",
      "x_nadsec_last_seen": "2026-05-05T15:54:30.109Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a071f222-f622-4686-983a-3955b0de2df5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T15:12:10.296Z",
      "x_nadsec_last_seen": "2026-05-05T15:12:42.958Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NZ; asn=4771; asn_org=Spark New Zealand Trading Ltd.",
      "id": "indicator--aa5553e1-9719-4d72-9dc8-43a95d6698a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.153.235.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-05T15:17:50.436Z",
      "x_nadsec_last_seen": "2026-05-08T08:31:35.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NZ"
      ],
      "x_nadsec_asns": [
        "4771"
      ],
      "x_nadsec_orgs": [
        "Spark New Zealand Trading Ltd."
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--966b8d55-4bcd-4865-83dc-7e5a9f7e93d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.172.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T16:00:39.260Z",
      "x_nadsec_last_seen": "2026-05-05T16:00:39.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:05:10.000Z",
      "valid_until": "2026-06-06T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T15:50:44.887Z",
      "x_nadsec_last_seen": "2026-05-31T08:14:22.898Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "81"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--067bb73f-f3b1-4234-a3c3-d435b3fd53e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.105.64.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:05:10.000Z",
      "valid_until": "2026-06-06T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T16:35:56.923Z",
      "x_nadsec_last_seen": "2026-05-05T16:38:01.139Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:05:10.000Z",
      "valid_until": "2026-06-06T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T16:31:35.597Z",
      "x_nadsec_last_seen": "2026-05-26T00:13:31.531Z",
      "x_nadsec_ports": [
        "135",
        "81",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=27717; asn_org=Corporacion Digitel C.A.",
      "id": "indicator--0e5018fa-1899-428b-bf9b-eabf9cdf592d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.167.48.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:05:10.000Z",
      "valid_until": "2026-06-06T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T16:44:23.869Z",
      "x_nadsec_last_seen": "2026-05-05T16:46:29.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "27717"
      ],
      "x_nadsec_orgs": [
        "Corporacion Digitel C.A."
      ]
    },
    {
      "created": "2026-05-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--145b541b-4da9-47a9-ad78-bc0e3d43480e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.8.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:05:10.000Z",
      "valid_until": "2026-06-06T17:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-05T17:04:23.239Z",
      "x_nadsec_last_seen": "2026-05-10T16:32:53.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--8c229e4b-4b79-4967-857a-b0472bb8189a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.53.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:05:10.000Z",
      "valid_until": "2026-06-06T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T16:42:42.823Z",
      "x_nadsec_last_seen": "2026-05-05T16:44:50.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=272925; asn_org=SAN JUAN INNOVA S.E.",
      "id": "indicator--0eb083f5-4a01-420c-9287-dff6ff372df6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.254.231.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:05:10.000Z",
      "valid_until": "2026-06-06T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T16:42:53.020Z",
      "x_nadsec_last_seen": "2026-05-05T16:43:00.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "272925"
      ],
      "x_nadsec_orgs": [
        "SAN JUAN INNOVA S.E."
      ]
    },
    {
      "created": "2026-05-05T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--3151fd99-b71c-4c52-9735-35d02808e487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.55.245.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:05:10.000Z",
      "valid_until": "2026-06-06T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T16:08:53.479Z",
      "x_nadsec_last_seen": "2026-05-05T16:16:09.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c135518a-5230-4acc-b1a6-7f886e351a43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.102.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T17:38:06.032Z",
      "x_nadsec_last_seen": "2026-05-05T17:40:14.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=35815; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--15b797fa-0a04-4d44-b6a9-0a4596968fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.198.118.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T17:41:43.577Z",
      "x_nadsec_last_seen": "2026-05-05T17:50:54.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35815"
      ],
      "x_nadsec_orgs": [
        "LLC Cifrovie Seti Urala"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9dc1202a-b53d-41fa-bcc0-e134a1c8c5e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.188.135.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T17:55:32.951Z",
      "x_nadsec_last_seen": "2026-05-05T17:55:37.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--be6109af-f42b-4164-944e-7fc7bb6e9a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.174.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T17:55:20.998Z",
      "x_nadsec_last_seen": "2026-05-05T17:55:50.317Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GT; asn=272061; asn_org=CROSS CONNECT LAC, S.A.",
      "id": "indicator--6572769e-0d23-49f6-895f-2a122f886253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.233.63.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T17:06:22.574Z",
      "x_nadsec_last_seen": "2026-05-23T11:04:40.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GT"
      ],
      "x_nadsec_asns": [
        "272061"
      ],
      "x_nadsec_orgs": [
        "CROSS CONNECT LAC, S.A."
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T17:05:38.956Z",
      "x_nadsec_last_seen": "2026-05-25T05:33:35.227Z",
      "x_nadsec_ports": [
        "1883",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--59418965-21f5-480f-bdd0-143e1cbad69a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.60.119.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-05T17:50:34.587Z",
      "x_nadsec_last_seen": "2026-05-20T07:00:35.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9c1098f3-f790-40c6-b821-efed09c35d86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.235.180.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T18:01:29.882Z",
      "x_nadsec_last_seen": "2026-05-05T18:03:36.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-05T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--aa477a97-f019-4b55-97bd-f57e6a938336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.191.209.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:05:10.000Z",
      "valid_until": "2026-06-06T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T17:45:47.354Z",
      "x_nadsec_last_seen": "2026-05-05T17:47:57.612Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--e68e9519-5533-47e5-9aef-f4a024f48c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.96.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T18:12:13.003Z",
      "x_nadsec_last_seen": "2026-05-05T18:20:34.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--dfe2b647-3324-48e2-b144-fa30b063e227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.236.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T18:50:48.533Z",
      "x_nadsec_last_seen": "2026-05-05T18:51:08.025Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--443c9f7e-0c7a-432d-97bf-30e20ea91b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.221.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T18:08:12.846Z",
      "x_nadsec_last_seen": "2026-05-05T18:08:34.685Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--41fd2789-0810-4f0c-8c76-2981c80e62f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.216.14.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T18:39:30.961Z",
      "x_nadsec_last_seen": "2026-05-05T18:39:36.503Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--34801dcc-feaa-4b6d-9bff-5c72d427ee19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T18:25:54.106Z",
      "x_nadsec_last_seen": "2026-05-05T18:25:54.106Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-05T19:00:35.893Z",
      "x_nadsec_last_seen": "2026-05-23T04:21:09.368Z",
      "x_nadsec_ports": [
        "3306",
        "81",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "httpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2da68240-ffa9-449b-9ebb-eea9c233a87c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T18:18:21.821Z",
      "x_nadsec_last_seen": "2026-05-05T18:18:51.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-05T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--2e714f28-9a9f-40f0-874f-7fd901d966c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.229.200.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:05:10.000Z",
      "valid_until": "2026-06-06T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T18:45:11.847Z",
      "x_nadsec_last_seen": "2026-05-05T18:47:18.434Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=210278; asn_org=Sky Italia srl",
      "id": "indicator--6a87644f-fefe-4ada-8575-61fe947742be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.56.133.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-05T19:47:42.998Z",
      "x_nadsec_last_seen": "2026-05-05T21:22:37.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "210278"
      ],
      "x_nadsec_orgs": [
        "Sky Italia srl"
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=139565; asn_org=Kord Broadband Services Pvt Ltd",
      "id": "indicator--bb26a76e-5434-489c-946c-43d6b291df3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.147.112.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T19:29:34.786Z",
      "x_nadsec_last_seen": "2026-05-05T19:36:03.685Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139565"
      ],
      "x_nadsec_orgs": [
        "Kord Broadband Services Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--0c0769ba-35b2-4f45-b3f9-42d81d40fd8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.2.156.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T19:07:39.390Z",
      "x_nadsec_last_seen": "2026-05-05T19:09:44.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=61738; asn_org=SECRETARIA DE ESTADO DE ECONOMIA DO DF - SEECDF",
      "id": "indicator--f46ce20a-65f7-4b66-8ba6-a7777c2753ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '131.72.220.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T19:34:52.540Z",
      "x_nadsec_last_seen": "2026-05-05T19:34:57.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61738"
      ],
      "x_nadsec_orgs": [
        "SECRETARIA DE ESTADO DE ECONOMIA DO DF - SEECDF"
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.176.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T19:29:13.813Z",
      "x_nadsec_last_seen": "2026-05-05T19:29:13.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--03380237-be83-4b82-b87e-c3c633be6615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.140.43.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T19:45:54.206Z",
      "x_nadsec_last_seen": "2026-05-05T19:47:59.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=27901; asn_org=Pacifico Cable SPA.",
      "id": "indicator--b22907a5-9403-4e93-b2af-4d4788cce400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.114.34.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T19:13:19.633Z",
      "x_nadsec_last_seen": "2026-05-05T19:15:26.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27901"
      ],
      "x_nadsec_orgs": [
        "Pacifico Cable SPA."
      ]
    },
    {
      "created": "2026-05-05T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--213bb2d8-8c08-47d7-8ec2-8c323dc58436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:05:05.000Z",
      "valid_until": "2026-06-06T20:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T19:24:08.318Z",
      "x_nadsec_last_seen": "2026-05-24T09:15:17.359Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US",
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6aadb73c-74a1-4cbd-9f1f-580cfaab8737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.123.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T20:39:07.833Z",
      "x_nadsec_last_seen": "2026-05-05T20:39:08.638Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--e20dedb9-6938-46a4-926c-f78600505df0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.51.229.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T20:34:15.927Z",
      "x_nadsec_last_seen": "2026-05-05T20:36:22.627Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=15895; asn_org=Kyivstar PJSC",
      "id": "indicator--496d3a4d-3c9f-4fa8-aa2d-6aac3c85b562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.163.102.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T20:24:47.137Z",
      "x_nadsec_last_seen": "2026-05-05T20:29:49.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15895"
      ],
      "x_nadsec_orgs": [
        "Kyivstar PJSC"
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--214ae1be-0c24-4142-8551-496f2a092ff4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T20:54:29.347Z",
      "x_nadsec_last_seen": "2026-05-05T20:54:29.347Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b965f4b7-8842-4600-9f71-b8b664a58ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T20:08:42.242Z",
      "x_nadsec_last_seen": "2026-05-05T20:08:42.242Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--f4995780-fa98-40f9-b48e-94349a4462a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T20:49:34.012Z",
      "x_nadsec_last_seen": "2026-05-22T10:24:52.866Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--84ecc34b-dbad-4f05-8d92-0da9d9158292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-05T20:45:28.056Z",
      "x_nadsec_last_seen": "2026-05-16T05:08:28.753Z",
      "x_nadsec_ports": [
        "42",
        "1883",
        "43105"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-05T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=39469; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--7c40d208-a0b6-4087-bf49-6d1c2ceafd44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:05:05.000Z",
      "valid_until": "2026-06-06T21:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T20:26:52.460Z",
      "x_nadsec_last_seen": "2026-05-16T05:10:53.312Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "135",
        "39469"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-05T22:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--ef72d438-f868-4a0f-b423-daffd8978ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.96.237.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:05:31.000Z",
      "valid_until": "2026-06-06T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T21:31:17.938Z",
      "x_nadsec_last_seen": "2026-05-20T08:34:40.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-05T22:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c8ce7a9e-11d2-4642-9a4e-98d93c39112d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:05:31.000Z",
      "valid_until": "2026-06-06T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-05T21:06:28.770Z",
      "x_nadsec_last_seen": "2026-05-07T05:10:40.317Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T22:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:05:31.000Z",
      "valid_until": "2026-06-06T22:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-05T21:30:23.831Z",
      "x_nadsec_last_seen": "2026-05-22T21:02:28.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T22:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:05:31.000Z",
      "valid_until": "2026-06-06T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T21:48:52.084Z",
      "x_nadsec_last_seen": "2026-05-05T21:48:52.084Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T22:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--f366ca98-7603-4e7c-b87e-e94963b72e16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.179.251.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:05:31.000Z",
      "valid_until": "2026-06-06T22:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-05T21:06:17.812Z",
      "x_nadsec_last_seen": "2026-05-05T21:48:57.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-05-05T22:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--3ef5d8d1-7750-4787-ba11-63252493644b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:05:31.000Z",
      "valid_until": "2026-06-06T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T21:22:04.957Z",
      "x_nadsec_last_seen": "2026-05-05T21:22:04.957Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-05T22:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--c75f5408-9d18-48b4-ab9e-5578c620d663",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T22:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:05:31.000Z",
      "valid_until": "2026-06-06T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T21:40:19.891Z",
      "x_nadsec_last_seen": "2026-05-10T04:19:09.689Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c4c0ae58-7ade-4ac7-b11d-2631ddda56eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.172.99.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-05-05T23:04:48.897Z",
      "x_nadsec_last_seen": "2026-05-06T06:12:17.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--f3274f03-f34f-4f3c-a7be-ffbfdc4de17e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.172.86.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T22:42:17.665Z",
      "x_nadsec_last_seen": "2026-05-05T22:44:22.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3e2defeb-4d9f-43b8-9a55-c1cf5221b878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.224.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T22:19:25.223Z",
      "x_nadsec_last_seen": "2026-05-05T22:26:01.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=52419; asn_org=CESOP",
      "id": "indicator--618334f8-f4b8-4722-961d-3b1b3f892c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.192.79.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T22:59:36.837Z",
      "x_nadsec_last_seen": "2026-05-05T22:59:36.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52419"
      ],
      "x_nadsec_orgs": [
        "CESOP"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3a17b304-d3a7-4ac0-8112-7cb8b8680bdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.219.57.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T22:52:59.756Z",
      "x_nadsec_last_seen": "2026-05-05T22:55:06.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T22:49:11.875Z",
      "x_nadsec_last_seen": "2026-05-05T22:49:11.875Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VE; asn=11562; asn_org=Net Uno, C.A.; user(top)=**",
      "id": "indicator--6aa169f7-dfc2-4fb7-b4e1-6cca60c70515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.75.154.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T22:59:12.320Z",
      "x_nadsec_last_seen": "2026-05-05T22:59:12.320Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=23951; asn_org=PT JEMBATAN CITRA NUSANTARA",
      "id": "indicator--80be61e7-0e1a-4796-8033-f9baf9f657f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.65.121.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T23:02:54.482Z",
      "x_nadsec_last_seen": "2026-05-05T23:04:58.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23951"
      ],
      "x_nadsec_orgs": [
        "PT JEMBATAN CITRA NUSANTARA"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--5a6cfc46-8b9e-4246-b2f0-dc9533f938c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.99.187.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T22:20:42.209Z",
      "x_nadsec_last_seen": "2026-05-15T16:32:36.554Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--f1a09134-0c90-4adf-ae36-d90f86844d2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.99.187.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-05T22:20:46.610Z",
      "x_nadsec_last_seen": "2026-05-31T20:26:25.912Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SG; asn=141995; asn_org=Contabo Asia Private Limited",
      "id": "indicator--b82020b2-4468-4e2f-92a2-2d2eda3d26f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.216.74.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T22:27:28.181Z",
      "x_nadsec_last_seen": "2026-05-05T22:27:28.181Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "141995"
      ],
      "x_nadsec_orgs": [
        "Contabo Asia Private Limited"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--56a34fb7-dcae-401a-8272-997988198477",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.163.203.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T22:41:51.492Z",
      "x_nadsec_last_seen": "2026-05-05T22:49:43.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-05T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8c53a92d-34e5-48da-9e57-14963060326e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-05T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.224.6.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:05:05.000Z",
      "valid_until": "2026-06-06T23:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-05T22:55:21.329Z",
      "x_nadsec_last_seen": "2026-05-06T17:31:06.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--4a2ef42a-661f-48e5-98c0-3f97b842469d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.111.8.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-05T23:24:58.929Z",
      "x_nadsec_last_seen": "2026-05-05T23:29:31.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d9d0b369-fe58-43a4-b76a-04b94a90adbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T00:00:47.302Z",
      "x_nadsec_last_seen": "2026-05-06T00:00:48.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SV; asn=26617; asn_org=Navega.com S.A.",
      "id": "indicator--3fad33d7-3e5c-4db7-bd66-c66d63a4f3d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.219.159.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T23:19:39.790Z",
      "x_nadsec_last_seen": "2026-05-05T23:19:46.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "26617"
      ],
      "x_nadsec_orgs": [
        "Navega.com S.A."
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--d1b927be-16b3-4b87-8969-063429fa63ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.158.36.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-05T23:52:13.010Z",
      "x_nadsec_last_seen": "2026-05-05T23:54:19.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f8a7854c-e153-4359-ba9f-ca86c10bdf75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.130.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T23:30:26.711Z",
      "x_nadsec_last_seen": "2026-05-05T23:30:26.711Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=5650; asn_org=Frontier Communications of America, Inc.",
      "id": "indicator--69a4e2e8-e081-448d-b867-ef148fcbbe91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.109.218.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-05T23:12:45.388Z",
      "x_nadsec_last_seen": "2026-05-28T17:48:28.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5650"
      ],
      "x_nadsec_orgs": [
        "Frontier Communications of America, Inc."
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--6c3084ca-fcbb-4961-9288-8829f2f5fbf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T23:55:30.736Z",
      "x_nadsec_last_seen": "2026-05-05T23:55:30.736Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--321681fe-e4a3-43a4-bd7c-c5ecbe3bd191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.129.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T23:59:05.279Z",
      "x_nadsec_last_seen": "2026-05-05T23:59:05.279Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--51cf2278-250f-4219-afee-6e8ffcf38a61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.171.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T23:59:05.848Z",
      "x_nadsec_last_seen": "2026-05-05T23:59:05.848Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--18437627-7310-41ec-b497-3a86f6c9a2d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.207.10.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-05T23:47:17.267Z",
      "x_nadsec_last_seen": "2026-05-28T09:51:47.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-05T23:41:34.113Z",
      "x_nadsec_last_seen": "2026-05-27T19:04:45.056Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld",
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--5fa29840-df92-4fff-83fa-af197bd68ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.57.151.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-05-05T23:32:36.243Z",
      "x_nadsec_last_seen": "2026-05-30T11:11:04.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-06T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--11cd300a-cbe3-4a04-9fb6-1f29606749c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:05:11.000Z",
      "valid_until": "2026-06-07T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-05T23:49:37.883Z",
      "x_nadsec_last_seen": "2026-05-05T23:49:37.883Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC; user(top)=**",
      "id": "indicator--e842f894-a7b1-4f0a-9169-f36c3d55bc7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.119.139.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:05:10.000Z",
      "valid_until": "2026-06-07T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T00:57:57.360Z",
      "x_nadsec_last_seen": "2026-05-06T00:57:57.360Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--3681f207-72f7-46a1-917a-d8eaaa5af221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:05:10.000Z",
      "valid_until": "2026-06-07T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T00:06:26.156Z",
      "x_nadsec_last_seen": "2026-05-06T00:06:26.156Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SG; asn=3758; asn_org=SingNet",
      "id": "indicator--dfee5d25-eb1c-48b1-ae32-52d7ef40d537",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.12.208.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T02:00:33.607Z",
      "x_nadsec_last_seen": "2026-05-06T02:02:37.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "3758"
      ],
      "x_nadsec_orgs": [
        "SingNet"
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--c00cacde-7369-4eb8-80c4-1aca3ffd16c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.187.50.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T01:56:53.694Z",
      "x_nadsec_last_seen": "2026-05-06T02:03:23.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--20da4fcd-ef81-4d8d-a339-3795049c7d0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.0.25.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-06T01:21:43.278Z",
      "x_nadsec_last_seen": "2026-05-19T09:40:27.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--49ea0dd2-13ca-471e-90c2-c8d3b3e45e06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.255.9.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T01:52:21.514Z",
      "x_nadsec_last_seen": "2026-05-06T03:18:50.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=60757; asn_org=Optinet LLP",
      "id": "indicator--2797d98a-c8c9-449a-9f93-822c7b406002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.217.188.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T01:39:53.179Z",
      "x_nadsec_last_seen": "2026-05-24T21:56:01.620Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "60757"
      ],
      "x_nadsec_orgs": [
        "Optinet LLP"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--79b94aa4-f50e-44f1-9731-11aca4d75734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T01:10:13.286Z",
      "x_nadsec_last_seen": "2026-05-06T01:10:13.286Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1fc57926-a57f-42a5-99cc-227b2ffab439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.77.174.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T01:28:37.818Z",
      "x_nadsec_last_seen": "2026-05-06T01:28:42.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f998b495-74de-45e4-b86e-50d2577d6b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.78.101.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T01:54:42.160Z",
      "x_nadsec_last_seen": "2026-05-06T01:54:46.970Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--5224ae45-fadc-4b0c-9d54-1fb18ad15206",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.70.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T01:23:41.840Z",
      "x_nadsec_last_seen": "2026-05-06T01:24:05.535Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=24534; asn_org=PT. Transhybrid Communication",
      "id": "indicator--add12936-ef07-49cf-94dc-354d41daf7f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.147.190.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T01:58:08.835Z",
      "x_nadsec_last_seen": "2026-05-22T04:46:08.466Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24534"
      ],
      "x_nadsec_orgs": [
        "PT. Transhybrid Communication"
      ]
    },
    {
      "created": "2026-05-06T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--dbe4897d-326a-4814-a197-d630fa66106e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:05:10.000Z",
      "valid_until": "2026-06-07T02:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-06T01:53:35.898Z",
      "x_nadsec_last_seen": "2026-05-29T13:18:42.886Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--cffd1e8c-6b36-4c46-8cb0-efab45b46c2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.167.98.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T02:35:28.422Z",
      "x_nadsec_last_seen": "2026-05-06T02:40:09.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--04c8b00c-e18f-4779-ba27-799ecc8bdc86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T02:34:53.508Z",
      "x_nadsec_last_seen": "2026-05-23T03:44:50.083Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--8eb4d42a-8a27-4f82-8fae-03696eb251fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.52.246.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T02:49:51.583Z",
      "x_nadsec_last_seen": "2026-05-06T02:51:57.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=58327; asn_org=Fibergreen Tecnologicas S.l.",
      "id": "indicator--7a5f813e-1c5f-4bc8-9b5b-674240ae65a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.239.4.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T02:13:57.597Z",
      "x_nadsec_last_seen": "2026-05-06T02:16:03.635Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "58327"
      ],
      "x_nadsec_orgs": [
        "Fibergreen Tecnologicas S.l."
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--5ee767bc-d40c-4b95-99a9-dafc1f73fd00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T02:26:35.655Z",
      "x_nadsec_last_seen": "2026-05-06T02:26:35.655Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c374350b-2780-4e9f-aadb-3d4434c04b44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.171.32.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T02:15:05.145Z",
      "x_nadsec_last_seen": "2026-05-06T02:15:05.145Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--3807e598-b30f-4efe-9638-cbaf8f1897c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.82.37.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T02:35:56.410Z",
      "x_nadsec_last_seen": "2026-05-06T02:38:01.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=VE; asn=271939; asn_org=REDES ELIAS, C.A.",
      "id": "indicator--6679b490-fff6-4b30-babd-ed8dff80a61f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.50.163.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-05-06T02:57:02.179Z",
      "x_nadsec_last_seen": "2026-05-06T03:00:28.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "271939"
      ],
      "x_nadsec_orgs": [
        "REDES ELIAS, C.A."
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52838; asn_org=WN TELECOM LTDA - ME",
      "id": "indicator--625a2785-435c-4435-ab25-d3b72203a879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.231.232.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T02:09:16.641Z",
      "x_nadsec_last_seen": "2026-05-06T02:11:23.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52838"
      ],
      "x_nadsec_orgs": [
        "WN TELECOM LTDA - ME"
      ]
    },
    {
      "created": "2026-05-06T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--97c841d5-9a19-424f-926f-7fca01106312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:05:10.000Z",
      "valid_until": "2026-06-07T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T02:42:13.267Z",
      "x_nadsec_last_seen": "2026-05-23T14:42:20.083Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T04:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--35ae37c6-40cd-4b99-b082-9235ff1def52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.10.219.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:05:06.000Z",
      "valid_until": "2026-06-07T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T03:17:55.437Z",
      "x_nadsec_last_seen": "2026-05-06T03:20:00.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-06T04:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--192d0b4e-14e7-421d-a4c7-111aff713dfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.165.120.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:05:06.000Z",
      "valid_until": "2026-06-07T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T03:59:54.315Z",
      "x_nadsec_last_seen": "2026-05-06T04:01:59.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T04:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--b245c357-e9e3-4fbe-9701-27dd561d661f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.99.14.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:05:06.000Z",
      "valid_until": "2026-06-07T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T03:32:12.715Z",
      "x_nadsec_last_seen": "2026-05-06T03:34:16.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-06T04:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:05:06.000Z",
      "valid_until": "2026-06-07T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T03:41:44.389Z",
      "x_nadsec_last_seen": "2026-05-06T03:41:44.389Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T04:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f4889665-112c-4ec5-99c3-8d7f26fc5569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.170.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:05:06.000Z",
      "valid_until": "2026-06-07T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T04:03:19.579Z",
      "x_nadsec_last_seen": "2026-05-06T04:03:19.579Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T04:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--82c6706c-0c54-4538-99ab-bca4d9e48b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.202.57.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:05:06.000Z",
      "valid_until": "2026-06-07T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T03:09:44.700Z",
      "x_nadsec_last_seen": "2026-05-29T02:20:52.921Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T04:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T04:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:05:06.000Z",
      "valid_until": "2026-06-07T04:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T03:19:34.287Z",
      "x_nadsec_last_seen": "2026-05-30T14:32:28.595Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd",
        "smbd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-06T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1774; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8740a66b-62a6-4684-9d32-1d9ea8b78089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.138.222.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:05:05.000Z",
      "valid_until": "2026-06-07T05:05:04.000Z",
      "x_nadsec_event_count": 3152,
      "x_nadsec_first_seen": "2026-05-06T04:40:45.041Z",
      "x_nadsec_last_seen": "2026-05-06T05:17:14.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d0313297-a812-4e35-aa3d-a0df086ad0e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.176.94.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:05:05.000Z",
      "valid_until": "2026-06-07T05:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T04:15:34.256Z",
      "x_nadsec_last_seen": "2026-05-12T08:56:14.993Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-06T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=4755; asn_org=TATA Communications formerly VSNL is Leading ISP",
      "id": "indicator--b778812e-cd2e-4351-b3e5-a010a1fdb624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.140.244.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:05:05.000Z",
      "valid_until": "2026-06-07T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T04:49:21.809Z",
      "x_nadsec_last_seen": "2026-05-06T04:51:26.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "4755"
      ],
      "x_nadsec_orgs": [
        "TATA Communications formerly VSNL is Leading ISP"
      ]
    },
    {
      "created": "2026-05-06T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5d84dea8-af68-4539-b4f3-cf872538fc5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:05:05.000Z",
      "valid_until": "2026-06-07T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T04:35:54.902Z",
      "x_nadsec_last_seen": "2026-05-06T04:35:55.427Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-06T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e882458e-b812-4802-bd3d-f847611050c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.98.166.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:05:05.000Z",
      "valid_until": "2026-06-07T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T04:47:56.613Z",
      "x_nadsec_last_seen": "2026-05-12T01:54:12.292Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SG; asn=3758; asn_org=SingNet",
      "id": "indicator--3fe71cd9-9c3d-4433-8fcf-58c247e874b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.185.70.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:05:05.000Z",
      "valid_until": "2026-06-07T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T04:34:21.896Z",
      "x_nadsec_last_seen": "2026-05-06T04:36:26.048Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "3758"
      ],
      "x_nadsec_orgs": [
        "SingNet"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133692; asn_org=Fastnet Communication Pvt. Ltd.",
      "id": "indicator--0e60fe17-1ad8-46f8-a110-9aabb2679614",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.47.219.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T05:13:33.271Z",
      "x_nadsec_last_seen": "2026-05-06T05:15:38.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133692"
      ],
      "x_nadsec_orgs": [
        "Fastnet Communication Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--3762658d-fe30-4c66-b52b-49aec290120e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.57.85.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T05:42:25.817Z",
      "x_nadsec_last_seen": "2026-05-06T05:44:31.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b3925b46-bfbe-4a49-a661-3fa3a393bc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T05:52:14.992Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:25.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f2e1c297-7fb5-466c-a994-4ac4ee7178bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:52:08.107Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:08.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--e4255cdc-bd7d-4c28-bb1d-af4cf127d6ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T05:52:02.949Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:04.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--398366fd-2bf1-4b93-aed7-767e22c1d733",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T05:51:53.846Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:28.524Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d5fa39fb-5df7-42ea-b6a9-c611c20e4add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:51:42.618Z",
      "x_nadsec_last_seen": "2026-05-06T05:51:42.618Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b707912a-a905-41d1-a9b9-1af91330cb3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:52:30.247Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:30.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2e2cd62e-3d3b-4c70-a8b0-b08999c30d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T05:52:09.825Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:13.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--536366f5-533f-48e3-9696-da5e6170c275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:52:21.648Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:21.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--a51943f8-ec2d-47a7-96b3-1b53b482c7e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:51:55.584Z",
      "x_nadsec_last_seen": "2026-05-06T05:51:55.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--676a3852-e0da-4d74-9ea9-12ff94ee9c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:52:26.806Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:26.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--9e552a55-92cf-439e-b472-4a03af6816ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:52:18.986Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:18.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--60818349-d469-4c5f-98b2-7465db58f20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-06T05:51:39.140Z",
      "x_nadsec_last_seen": "2026-05-06T05:51:59.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T05:51:40.873Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:11.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--9d487fca-d9ee-435d-ace6-f6d3c27ea88e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T05:52:00.791Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:35.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--68016460-722c-44e2-84b2-a8f2b9844860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T05:51:52.055Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:19.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--fd6d3eac-e257-4ae3-9eb4-3b38f3e73dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T05:52:01.231Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:33.690Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d720fe87-37b8-40bd-a5f0-58f51ef0110d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:52:21.157Z",
      "x_nadsec_last_seen": "2026-05-06T05:52:21.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d22682ab-4c54-4886-a982-d485e417d88d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.177.180.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:58:01.959Z",
      "x_nadsec_last_seen": "2026-05-06T05:58:01.959Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=47329; asn_org=WDM Sp. z o.o.",
      "id": "indicator--fb927473-9b2e-4e87-9a08-42117e17ef4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.39.160.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T05:15:08.026Z",
      "x_nadsec_last_seen": "2026-05-06T05:17:17.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "47329"
      ],
      "x_nadsec_orgs": [
        "WDM Sp. z o.o."
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--ed53c496-4111-4db5-bff8-441e36cc7a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.164.226.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T06:03:48.929Z",
      "x_nadsec_last_seen": "2026-05-06T06:07:57.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f8a3ae2b-73d3-4bb6-a9ee-74188536f9b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T05:29:40.938Z",
      "x_nadsec_last_seen": "2026-05-06T05:29:40.938Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--128a59f0-1260-4a91-b7c2-1aea60d1d47d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.243.49.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T06:05:11.000Z",
      "valid_until": "2026-06-07T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T05:13:05.889Z",
      "x_nadsec_last_seen": "2026-05-06T05:15:10.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--97579288-1ce1-433b-b90e-c38bf480d5b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.2.213.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-06T07:02:51.399Z",
      "x_nadsec_last_seen": "2026-05-06T08:25:51.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--e5547781-b301-4744-ba2b-bff80fcdbc0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.74.79.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T06:40:28.234Z",
      "x_nadsec_last_seen": "2026-05-06T06:46:57.141Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--a0773091-7b7b-40b0-bafb-b46485cb1c2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.28.15.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-06T06:33:43.404Z",
      "x_nadsec_last_seen": "2026-05-06T06:33:52.932Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--928c9e5b-204f-4c5c-a1e2-dabe7a39fcf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.69.180.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T06:34:45.351Z",
      "x_nadsec_last_seen": "2026-05-06T06:41:54.919Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--f0eadbd9-86bb-4d46-b109-26eaa2bc4bbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.80.44.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-06T06:27:09.171Z",
      "x_nadsec_last_seen": "2026-05-22T13:34:59.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=8167; asn_org=V tal; user(top)=**",
      "id": "indicator--8d0ec880-2442-46cc-9ee6-595f2d1bd7e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.2.251.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T06:11:20.352Z",
      "x_nadsec_last_seen": "2026-05-06T06:11:20.352Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "8167"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=26496; asn_org=GoDaddy.com, LLC",
      "id": "indicator--96b42dd9-66b2-4a94-add4-b9ec1a1ed737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '208.109.10.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T06:33:57.721Z",
      "x_nadsec_last_seen": "2026-05-22T20:29:00.031Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "26496"
      ],
      "x_nadsec_orgs": [
        "GoDaddy.com, LLC"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2084; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--d0e5662f-3722-4fea-96cd-ca535d52d4fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.245.49.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 3152,
      "x_nadsec_first_seen": "2026-05-06T06:32:07.958Z",
      "x_nadsec_last_seen": "2026-05-06T07:20:11.523Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--2e12e835-39b1-4686-a03f-c8fde9112b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.49.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T06:40:02.742Z",
      "x_nadsec_last_seen": "2026-05-06T06:40:40.492Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--1e323165-2385-478f-a584-433dbf27505a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.78.175.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T06:39:20.532Z",
      "x_nadsec_last_seen": "2026-05-06T06:39:20.532Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--927668ca-97c1-4f68-9fd1-bd48a0c214f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.78.189.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T18:21:45.134Z",
      "x_nadsec_last_seen": "2026-05-21T10:37:25.725Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8155219a-4b72-4875-8525-57dfdd952dad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.79.207.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T06:52:26.124Z",
      "x_nadsec_last_seen": "2026-05-06T06:54:30.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--89bb1cb3-34d2-4dd3-b76d-72769a36a53b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.125.74.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-06T06:35:24.739Z",
      "x_nadsec_last_seen": "2026-05-15T09:07:26.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T06:33:16.982Z",
      "x_nadsec_last_seen": "2026-05-26T20:32:29.063Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--5bfc1902-4780-478f-874f-b35a13c56bdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.187.32.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T06:47:55.539Z",
      "x_nadsec_last_seen": "2026-05-06T06:47:55.539Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=33871; asn_org=Norilsk-Telecom JSC",
      "id": "indicator--b980e86c-9bf3-4a7a-a9ee-3c69606b674b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.67.213.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T06:30:14.339Z",
      "x_nadsec_last_seen": "2026-05-06T06:36:26.780Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33871"
      ],
      "x_nadsec_orgs": [
        "Norilsk-Telecom JSC"
      ]
    },
    {
      "created": "2026-05-06T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3333c787-4c16-407f-ad76-c67374481c41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.10.45.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:05:09.000Z",
      "valid_until": "2026-06-07T07:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-06T06:55:48.134Z",
      "x_nadsec_last_seen": "2026-05-29T01:19:43.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-06T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--eba01a3a-bd7b-49be-98cb-442ca82c8ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.137.208.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:05:10.000Z",
      "valid_until": "2026-06-07T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T07:34:33.106Z",
      "x_nadsec_last_seen": "2026-05-06T07:36:37.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--f90dc26b-99b0-4335-9eaa-e6367028646b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.103.117.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:05:10.000Z",
      "valid_until": "2026-06-07T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T07:23:48.887Z",
      "x_nadsec_last_seen": "2026-05-06T07:30:25.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "17676"
      ],
      "x_nadsec_orgs": [
        "SoftBank Corp."
      ]
    },
    {
      "created": "2026-05-06T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24173; asn_org=Netnam Company",
      "id": "indicator--2dbcef77-f556-4c93-92d8-f5278e1ed1b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.15.169.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:05:10.000Z",
      "valid_until": "2026-06-07T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T07:42:12.768Z",
      "x_nadsec_last_seen": "2026-05-06T07:44:18.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24173"
      ],
      "x_nadsec_orgs": [
        "Netnam Company"
      ]
    },
    {
      "created": "2026-05-06T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--696b9d3f-e721-4210-b0cb-a03ab0aceca1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.23.47.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:05:10.000Z",
      "valid_until": "2026-06-07T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T07:42:08.071Z",
      "x_nadsec_last_seen": "2026-05-06T07:44:13.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-06T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--bbcea2fd-9029-4973-8968-1f32abec5b6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.250.153.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:05:10.000Z",
      "valid_until": "2026-06-07T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T07:41:12.162Z",
      "x_nadsec_last_seen": "2026-05-06T07:43:17.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-06T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--4d2c0a9b-6cfb-4e44-82e1-880ca15ee12c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.161.46.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:05:10.000Z",
      "valid_until": "2026-06-07T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T07:41:58.021Z",
      "x_nadsec_last_seen": "2026-05-06T07:41:58.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "32098"
      ],
      "x_nadsec_orgs": [
        "Transtelco Inc"
      ]
    },
    {
      "created": "2026-05-06T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30848; asn_org=UNIDATA S.p.A.",
      "id": "indicator--72de38f1-167c-4d80-af5f-b0cd4133096f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.217.182.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T08:05:10.000Z",
      "valid_until": "2026-06-07T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T07:49:15.044Z",
      "x_nadsec_last_seen": "2026-05-06T07:51:21.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30848"
      ],
      "x_nadsec_orgs": [
        "UNIDATA S.p.A."
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--de418769-d276-442f-8623-c3a68077477c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.154.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T08:09:01.632Z",
      "x_nadsec_last_seen": "2026-05-06T08:15:36.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--c7a90778-25da-42e1-842c-546a608399dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.142.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T08:08:09.308Z",
      "x_nadsec_last_seen": "2026-05-06T08:08:09.602Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37130; asn_org=SITA-AS",
      "id": "indicator--3b41e358-ba7e-4339-bb63-933db3f26417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.151.136.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-06T08:21:28.089Z",
      "x_nadsec_last_seen": "2026-05-30T15:32:50.723Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37130"
      ],
      "x_nadsec_orgs": [
        "SITA-AS"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=137159; asn_org=Krishna Infonet Private Limited",
      "id": "indicator--4560348a-f2d1-460b-90bf-33336c86eeb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.99.237.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T08:10:40.634Z",
      "x_nadsec_last_seen": "2026-05-06T08:12:47.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137159"
      ],
      "x_nadsec_orgs": [
        "Krishna Infonet Private Limited"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f60c76ad-acb3-48b2-832b-24c06387ebe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.142.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T08:25:46.614Z",
      "x_nadsec_last_seen": "2026-05-06T08:25:46.614Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9142b5a8-0fd2-4389-9a5e-6d6ef54ea625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.0.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T09:00:39.444Z",
      "x_nadsec_last_seen": "2026-05-06T09:02:46.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--07ef57cd-0b34-4e81-945c-fd43df8976f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T08:53:34.645Z",
      "x_nadsec_last_seen": "2026-05-06T08:53:34.645Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1c73006b-b358-4077-81a8-36f02a19333a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.249.103.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T08:37:50.244Z",
      "x_nadsec_last_seen": "2026-05-06T08:45:16.574Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--87fa86a2-d9d9-4c1b-9d95-10c197e82d06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T08:06:44.559Z",
      "x_nadsec_last_seen": "2026-05-06T08:06:44.559Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--ac58b978-d197-4271-b1f0-5f2bec9a7163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.228.141.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T08:55:34.852Z",
      "x_nadsec_last_seen": "2026-05-06T09:02:49.755Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--a0ddbc16-5b85-4254-b6f4-38d6df3bdb93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.187.50.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T08:42:24.015Z",
      "x_nadsec_last_seen": "2026-05-06T08:49:17.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-06T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--2627b319-1fb3-4d17-bd4f-75a1cf039545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.56.215.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:05:11.000Z",
      "valid_until": "2026-06-07T09:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-05-06T08:18:58.798Z",
      "x_nadsec_last_seen": "2026-05-23T23:33:46.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--0766fcf0-30ce-4305-8722-676c540b1eb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.51.26.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T09:29:29.784Z",
      "x_nadsec_last_seen": "2026-05-06T09:31:35.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cee589b5-1615-41c9-aa43-bc86cc27c9d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.171.139.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T09:47:29.019Z",
      "x_nadsec_last_seen": "2026-05-06T09:47:33.756Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mirrorc; ports=38473; cc=US; asn=5650; asn_org=Frontier Communications of America, Inc.",
      "id": "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.99.61.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 35,
      "x_nadsec_first_seen": "2026-05-06T09:52:41.653Z",
      "x_nadsec_last_seen": "2026-05-26T23:31:02.425Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "3306",
        "34553",
        "38473",
        "39607",
        "44707"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5650"
      ],
      "x_nadsec_orgs": [
        "Frontier Communications of America, Inc."
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6d4fa4f6-883a-4173-a209-4a9c930b1f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.118.32.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T09:52:57.763Z",
      "x_nadsec_last_seen": "2026-05-06T09:53:07.938Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3c85ea9e-757c-4e18-bf3b-c6afa4501e0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.48.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T09:32:47.868Z",
      "x_nadsec_last_seen": "2026-05-06T09:32:58.010Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--f422971d-2434-4b7f-bebf-4a46c38aab5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.70.66.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T09:20:18.835Z",
      "x_nadsec_last_seen": "2026-05-06T09:23:53.261Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--6734641a-e230-4d68-9ed8-c10affc84904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.58.204.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T09:11:37.954Z",
      "x_nadsec_last_seen": "2026-05-06T09:13:44.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cc667c24-c4c1-4a13-b407-1a01cbbce293",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.141.85.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T09:34:23.684Z",
      "x_nadsec_last_seen": "2026-05-06T09:36:30.452Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--a15541db-e961-458e-aba1-b348be38c50e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T09:38:21.083Z",
      "x_nadsec_last_seen": "2026-05-30T07:57:59.848Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-06T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--08b18a8c-0c0e-43cc-908a-0af44eef5355",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.187.46.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:05:10.000Z",
      "valid_until": "2026-06-07T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T09:08:52.760Z",
      "x_nadsec_last_seen": "2026-05-06T09:15:57.964Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--ca3fbf8b-84c1-4793-bb21-fbb765f1f972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '126.31.43.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T10:37:48.841Z",
      "x_nadsec_last_seen": "2026-05-06T10:39:54.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "17676"
      ],
      "x_nadsec_orgs": [
        "SoftBank Corp."
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SC; asn=153656; asn_org=OWGELS INTERNATIONAL CO., LIMITED",
      "id": "indicator--6b46e7df-41d5-4edd-9fef-8e05fac84d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.197.141.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T10:54:02.510Z",
      "x_nadsec_last_seen": "2026-05-06T10:56:06.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "153656"
      ],
      "x_nadsec_orgs": [
        "OWGELS INTERNATIONAL CO., LIMITED"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--90670556-e247-4b70-bc5d-7d18025d5446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-06T10:28:37.138Z",
      "x_nadsec_last_seen": "2026-05-21T21:52:30.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--eae946a8-97a2-4871-bcb1-58c2641c715b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.0.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T10:57:24.496Z",
      "x_nadsec_last_seen": "2026-05-06T11:05:45.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--e1bb74eb-ae1c-4588-ae4d-d892ba43e36d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.134.219.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T10:35:39.924Z",
      "x_nadsec_last_seen": "2026-05-06T10:35:46.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dc6eb686-b43b-452e-9264-fa729961821d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T10:26:06.334Z",
      "x_nadsec_last_seen": "2026-05-06T10:26:16.495Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GA; asn=16058; asn_org=Gabon-Telecom",
      "id": "indicator--25c2e7e7-40ee-431d-9ac4-fb8c0ccf2a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.159.133.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T10:32:09.646Z",
      "x_nadsec_last_seen": "2026-05-29T11:27:42.560Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GA"
      ],
      "x_nadsec_asns": [
        "16058"
      ],
      "x_nadsec_orgs": [
        "Gabon-Telecom"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1ebc9dfb-2a26-4683-b163-5eabf1c28729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.14.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T10:39:43.800Z",
      "x_nadsec_last_seen": "2026-05-06T10:41:51.024Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T10:37:11.011Z",
      "x_nadsec_last_seen": "2026-05-06T10:37:11.011Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-06T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=15377; asn_org=Traditional LLC",
      "id": "indicator--f386e6e9-7dec-4d81-8f8e-2b3f20b9f4e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.243.198.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T11:05:10.000Z",
      "valid_until": "2026-06-07T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-06T10:38:18.564Z",
      "x_nadsec_last_seen": "2026-05-27T21:25:07.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15377"
      ],
      "x_nadsec_orgs": [
        "Traditional LLC"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b414dc59-0a03-4e53-b059-9982b744c326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.180.139.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T11:10:23.767Z",
      "x_nadsec_last_seen": "2026-05-06T11:12:28.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--82132550-a1ea-4fe6-97e9-c08e5d718ee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.212.61.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T11:45:31.981Z",
      "x_nadsec_last_seen": "2026-05-06T11:47:39.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--f28ac2df-959f-43b5-b729-224973b5c1c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.57.104.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T11:19:42.567Z",
      "x_nadsec_last_seen": "2026-05-06T11:21:51.768Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--9c8a88d3-9852-4fba-addf-6dbc74d5d858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.32.154.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T11:53:31.306Z",
      "x_nadsec_last_seen": "2026-05-24T18:36:22.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--1bde6af3-45a9-4667-8a2f-d61a4baac743",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.229.195.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T12:00:59.394Z",
      "x_nadsec_last_seen": "2026-05-06T12:08:35.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=327934; asn_org=Tunisie-Telecom",
      "id": "indicator--b075924d-11fc-4b55-9d38-a675622be482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.11.8.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T11:31:31.082Z",
      "x_nadsec_last_seen": "2026-05-06T11:31:38.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "327934"
      ],
      "x_nadsec_orgs": [
        "Tunisie-Telecom"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2270; services=mssqld; ports=1433; cc=AE; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--be17d8ec-4432-43e9-9543-2c1cf045db2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.46.55.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 2270,
      "x_nadsec_first_seen": "2026-05-06T11:51:18.720Z",
      "x_nadsec_last_seen": "2026-05-06T11:57:06.296Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--dbdb1a72-231b-45f8-b7c4-33ad6993f7ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.111.247.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-06T11:22:27.918Z",
      "x_nadsec_last_seen": "2026-05-11T16:32:55.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c253af42-2a8c-4c63-82d9-827ad3ae67c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T11:32:25.900Z",
      "x_nadsec_last_seen": "2026-05-06T11:32:25.900Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-06T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=17139; asn_org=Corporate Colocation Inc.",
      "id": "indicator--4949010d-7b5f-4c3a-80e5-56c2d3f010a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.64.170.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:05:10.000Z",
      "valid_until": "2026-06-07T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T11:10:48.424Z",
      "x_nadsec_last_seen": "2026-05-06T21:59:41.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "17139"
      ],
      "x_nadsec_orgs": [
        "Corporate Colocation Inc."
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--3ef755b2-997b-4842-8fca-e2d0190bf9f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.71.65.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T12:29:04.212Z",
      "x_nadsec_last_seen": "2026-05-06T12:29:11.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6cc71d96-c51c-4f37-a14d-bcaa17de9849",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.227.98.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T12:50:48.930Z",
      "x_nadsec_last_seen": "2026-05-06T12:58:24.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dcc132d6-0ca7-4fb7-89d7-bfb1a7b40991",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T12:13:59.054Z",
      "x_nadsec_last_seen": "2026-05-06T12:13:59.054Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mysqld; ports=3306; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-05-06T12:15:54.302Z",
      "x_nadsec_last_seen": "2026-05-06T15:44:57.607Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "445",
        "3306",
        "42",
        "81",
        "1433",
        "1883",
        "27017",
        "34955"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "smbd",
        "mysqld",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--7d42d0ed-8576-4db0-af0a-caeedd8fb512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T12:29:14.277Z",
      "x_nadsec_last_seen": "2026-05-06T12:29:14.277Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--bddd1e2e-89a8-4907-a641-b514b397349e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.191.78.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T12:11:15.406Z",
      "x_nadsec_last_seen": "2026-05-25T19:54:22.094Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--4f25897d-16f3-4120-a40c-692de0e7ee43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '219.77.168.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T12:43:46.545Z",
      "x_nadsec_last_seen": "2026-05-06T12:50:01.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mirrorc; ports=42429; cc=US; asn=174; asn_org=Cogent Communications, LLC",
      "id": "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.123.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-06T12:35:42.898Z",
      "x_nadsec_last_seen": "2026-05-06T12:35:47.431Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "3306",
        "42429"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "174"
      ],
      "x_nadsec_orgs": [
        "Cogent Communications, LLC"
      ]
    },
    {
      "created": "2026-05-06T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--14e3e1e6-fa85-484b-b6da-b7719624bec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.50.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:05:05.000Z",
      "valid_until": "2026-06-07T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T12:31:49.037Z",
      "x_nadsec_last_seen": "2026-05-06T12:33:55.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-06T14:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c203c710-2809-443b-b447-ff2550958617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.91.93.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:05:17.000Z",
      "valid_until": "2026-06-07T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T13:26:07.903Z",
      "x_nadsec_last_seen": "2026-05-06T13:28:15.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-06T14:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6a22c6fe-44a9-49ef-9704-9ba5a0806c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.37.136.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:05:17.000Z",
      "valid_until": "2026-06-07T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T14:01:49.826Z",
      "x_nadsec_last_seen": "2026-05-06T14:08:50.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-06T14:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4fb71f08-cb33-4bfe-b15e-09086e6138de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:05:17.000Z",
      "valid_until": "2026-06-07T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T14:00:36.499Z",
      "x_nadsec_last_seen": "2026-05-06T14:00:46.658Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T14:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--14999595-8ebe-49c1-a4db-a10ecf9d804e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.33.172.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:05:17.000Z",
      "valid_until": "2026-06-07T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T13:20:04.319Z",
      "x_nadsec_last_seen": "2026-05-06T13:22:12.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-06T14:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:05:17.000Z",
      "valid_until": "2026-06-07T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T13:56:19.980Z",
      "x_nadsec_last_seen": "2026-05-06T16:31:40.539Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-06T14:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T14:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:05:17.000Z",
      "valid_until": "2026-06-07T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T13:38:58.677Z",
      "x_nadsec_last_seen": "2026-05-19T03:16:06.060Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--1aed2b52-edc4-4c40-9776-5b164356ab47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.115.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T14:26:51.874Z",
      "x_nadsec_last_seen": "2026-05-06T14:29:00.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--36a9f66f-318d-40ab-8517-b2d3bfc2e23a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.92.24.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T14:28:32.965Z",
      "x_nadsec_last_seen": "2026-05-06T14:30:40.421Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=TH; asn=9335; asn_org=National Telecom Public Company Limited",
      "id": "indicator--277aee55-a234-41ba-aeb6-d99a67309183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.78.211.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-06T14:08:43.457Z",
      "x_nadsec_last_seen": "2026-05-06T14:08:48.565Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9335"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "0****0"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--870e4053-c17d-4e67-bc68-e1fad57c3da9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.24.205.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T14:18:00.506Z",
      "x_nadsec_last_seen": "2026-05-06T14:24:52.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--69c0da84-39e0-472f-a358-e98378ae9727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.102.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T14:49:50.748Z",
      "x_nadsec_last_seen": "2026-05-06T14:49:50.748Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--5b2f0804-a7a8-4612-8646-94904618a463",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.27.53.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T14:48:28.131Z",
      "x_nadsec_last_seen": "2026-05-06T14:56:07.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PA; asn=52468; asn_org=UFINET PANAMA S.A.",
      "id": "indicator--d1922af9-a3e3-4b77-b089-0a74477a88c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.61.125.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-06T14:13:25.071Z",
      "x_nadsec_last_seen": "2026-05-20T00:17:20.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "52468"
      ],
      "x_nadsec_orgs": [
        "UFINET PANAMA S.A."
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--d7a77daa-431a-439a-b365-b6eb7f17aafd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.23.34.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-06T14:28:22.187Z",
      "x_nadsec_last_seen": "2026-05-06T14:30:51.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--7354e646-9057-4c56-ab2d-e1ce520da910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.93.160.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T14:18:03.388Z",
      "x_nadsec_last_seen": "2026-05-06T14:18:03.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--0b02ae80-b0c8-49a2-ad94-02cb66b48fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.143.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T14:14:11.453Z",
      "x_nadsec_last_seen": "2026-05-06T14:14:11.453Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--847635cb-a39c-460e-baf5-85b14bde31a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.205.205.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T14:07:17.600Z",
      "x_nadsec_last_seen": "2026-05-06T14:14:22.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--9133bb7a-3fdc-4fd0-be55-d5f9ef46471b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T14:41:34.112Z",
      "x_nadsec_last_seen": "2026-05-26T23:02:10.510Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3410742f-72be-4104-817e-c49886f6107a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T14:40:29.104Z",
      "x_nadsec_last_seen": "2026-05-06T14:40:29.104Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--835d8321-4a92-4944-a74b-7ec349bf418b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T14:41:22.743Z",
      "x_nadsec_last_seen": "2026-05-06T14:41:23.149Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-06T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--59cff2fa-9f35-459d-933b-13eb9d0eccc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:05:11.000Z",
      "valid_until": "2026-06-07T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T14:40:28.851Z",
      "x_nadsec_last_seen": "2026-05-27T14:44:07.680Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f8d14e13-2398-4bbd-be63-45ab6235e595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.58.200.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T15:31:59.851Z",
      "x_nadsec_last_seen": "2026-05-06T15:32:29.153Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--500816f1-bd04-4dba-9f4d-75c13c2b8d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T15:07:34.837Z",
      "x_nadsec_last_seen": "2026-05-18T05:28:37.214Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T15:34:18.649Z",
      "x_nadsec_last_seen": "2026-05-26T10:00:22.060Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=6876; asn_org=TENET Scientific Production Enterprise LLC",
      "id": "indicator--a6b6e82b-1e25-41b1-ae97-ee23e8ec24d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.138.83.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T15:42:58.737Z",
      "x_nadsec_last_seen": "2026-05-06T15:50:23.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6876"
      ],
      "x_nadsec_orgs": [
        "TENET Scientific Production Enterprise LLC"
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--c1d69374-da9f-4a18-b2a8-2de8978760ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.124.95.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T15:18:13.666Z",
      "x_nadsec_last_seen": "2026-05-06T15:20:19.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--37b4d82a-8d22-488e-a65f-92d625cb5cfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.108.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T15:39:44.727Z",
      "x_nadsec_last_seen": "2026-05-06T15:40:01.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ee69a1de-760c-45f3-bdf2-6b43ffdceb66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T15:32:15.875Z",
      "x_nadsec_last_seen": "2026-05-06T15:32:15.875Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--464dcef3-c31b-43b5-8cb9-1c5581357fe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T15:32:13.934Z",
      "x_nadsec_last_seen": "2026-05-29T09:37:01.210Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8eb2264c-3b5c-424a-bfda-7f81cfecb89f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T15:32:05.196Z",
      "x_nadsec_last_seen": "2026-05-06T15:32:05.196Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T15:59:18.725Z",
      "x_nadsec_last_seen": "2026-05-31T13:22:50.672Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-06T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4ec0c3dc-f6e0-497b-b5f9-fd24f30d01e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.249.30.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:05:10.000Z",
      "valid_until": "2026-06-07T16:05:09.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-05-06T15:53:56.736Z",
      "x_nadsec_last_seen": "2026-05-28T00:35:07.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ZA; asn=327782; asn_org=METROFIBRE-NETWORX",
      "id": "indicator--b302d0b8-e9db-4b9d-a6dc-ec2a8e4ce68f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.33.152.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-05-06T16:39:02.191Z",
      "x_nadsec_last_seen": "2026-05-06T19:07:34.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327782"
      ],
      "x_nadsec_orgs": [
        "METROFIBRE-NETWORX"
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=131111; asn_org=PT Mora Telematika Indonesia",
      "id": "indicator--15faa60c-96e6-4261-8320-79fed57cd28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.154.111.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T16:49:53.874Z",
      "x_nadsec_last_seen": "2026-05-15T23:00:00.355Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131111"
      ],
      "x_nadsec_orgs": [
        "PT Mora Telematika Indonesia"
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=9318; asn_org=SK Broadband Co Ltd",
      "id": "indicator--715faa72-56ac-40a5-b3fa-48b4b8c57368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.200.239.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-06T16:38:12.324Z",
      "x_nadsec_last_seen": "2026-05-25T23:00:09.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "9318"
      ],
      "x_nadsec_orgs": [
        "SK Broadband Co Ltd"
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--6dee1c67-5de6-4de9-8be4-378f6a4e1542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.255.47.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T16:42:18.943Z",
      "x_nadsec_last_seen": "2026-05-06T16:49:26.976Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--560a30cf-989e-4be9-9d6e-a9bfb775be50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.106.196.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T16:25:30.858Z",
      "x_nadsec_last_seen": "2026-05-06T16:25:31.259Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--21e2de84-3313-4faf-b982-c6ce545f28fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.154.95.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T16:09:30.426Z",
      "x_nadsec_last_seen": "2026-05-06T16:16:26.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TZ; asn=33765; asn_org=TTCLDATA",
      "id": "indicator--d9336836-2cae-4d28-b949-616ce88ef746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.59.90.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T17:02:36.509Z",
      "x_nadsec_last_seen": "2026-05-06T17:10:08.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TZ"
      ],
      "x_nadsec_asns": [
        "33765"
      ],
      "x_nadsec_orgs": [
        "TTCLDATA"
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--4f5f2eb2-22ff-43f8-82c6-ed3c45df5b22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.129.109.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T17:02:16.296Z",
      "x_nadsec_last_seen": "2026-05-06T17:07:19.525Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-05-06T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--d7a0a70f-d6bd-4bd2-ab6d-f5ac9bf7c619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.56.166.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:05:10.000Z",
      "valid_until": "2026-06-07T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T16:48:43.649Z",
      "x_nadsec_last_seen": "2026-05-06T16:50:49.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=135247; asn_org=K Net Solutions Pvt Ltd; user(top)=**",
      "id": "indicator--314f9fd8-ef40-4316-b0f2-57b61fa52cbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.216.142.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T17:44:07.513Z",
      "x_nadsec_last_seen": "2026-05-24T14:18:17.525Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135247"
      ],
      "x_nadsec_orgs": [
        "K Net Solutions Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--a0c9f9c8-795d-450a-bbc6-63e7c461f588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.5.13.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T17:14:15.297Z",
      "x_nadsec_last_seen": "2026-05-06T17:16:19.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6aff7db0-ada6-4b13-82c1-a4cbd087f13a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T17:43:08.391Z",
      "x_nadsec_last_seen": "2026-05-23T15:56:49.981Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--2c05c4a3-3e10-4311-8088-721c0fff5404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T17:59:09.602Z",
      "x_nadsec_last_seen": "2026-05-06T17:59:09.602Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IL; asn=12400; asn_org=Partner Communications Ltd.",
      "id": "indicator--7a0006bd-c9e1-42c3-a0f6-a5d677d8b1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.154.162.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-06T18:05:04.266Z",
      "x_nadsec_last_seen": "2026-05-18T16:08:06.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=36914; asn_org=Kenya Education Network",
      "id": "indicator--0c279790-f831-47fa-932d-25340fcb0c1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.89.96.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-05-06T17:17:52.221Z",
      "x_nadsec_last_seen": "2026-05-23T12:38:00.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36914"
      ],
      "x_nadsec_orgs": [
        "Kenya Education Network"
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--4542ee94-bbe0-4f6f-96a0-b1f5e3a09d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.83.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T17:10:01.532Z",
      "x_nadsec_last_seen": "2026-05-06T17:10:01.532Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-06T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=9416; asn_org=Hoshin Multimedia Center Inc.",
      "id": "indicator--61de1f87-bfc6-4f85-a51a-ff79c8fd7fad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.70.252.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T18:05:10.000Z",
      "valid_until": "2026-06-07T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T17:38:56.986Z",
      "x_nadsec_last_seen": "2026-05-06T17:41:01.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9416"
      ],
      "x_nadsec_orgs": [
        "Hoshin Multimedia Center Inc."
      ]
    },
    {
      "created": "2026-05-06T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3d732f2e-2800-41e0-a137-1590a77e4091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.198.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:05:10.000Z",
      "valid_until": "2026-06-07T19:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T18:46:57.084Z",
      "x_nadsec_last_seen": "2026-05-22T18:29:24.174Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-06T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c2a2eef6-c628-49a3-b1e5-a9592345eab2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.128.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:05:10.000Z",
      "valid_until": "2026-06-07T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T19:04:50.448Z",
      "x_nadsec_last_seen": "2026-05-06T19:05:12.834Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37148; asn_org=globacom-as",
      "id": "indicator--4f1b4e64-4315-4cc0-b7b0-a4c48c69c47e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.211.52.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:05:10.000Z",
      "valid_until": "2026-06-07T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T18:39:16.480Z",
      "x_nadsec_last_seen": "2026-05-06T18:41:31.188Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37148"
      ],
      "x_nadsec_orgs": [
        "globacom-as"
      ]
    },
    {
      "created": "2026-05-06T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7717f42a-4a82-4753-9827-3fcf779a8944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.223.20.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:05:10.000Z",
      "valid_until": "2026-06-07T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T18:47:01.550Z",
      "x_nadsec_last_seen": "2026-05-21T01:08:07.268Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9eb9c37c-a576-49a2-82e0-8c452d30be63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.44.78.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T19:35:24.021Z",
      "x_nadsec_last_seen": "2026-05-06T21:21:25.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--9e9d79fe-3fa2-4f58-b5f9-90775c35e1fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.186.189.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T19:30:05.179Z",
      "x_nadsec_last_seen": "2026-05-06T19:36:57.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1f34b5cf-a162-4576-b885-abc844c2fbdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.235.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T19:40:19.497Z",
      "x_nadsec_last_seen": "2026-05-06T19:40:38.898Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269820; asn_org=FULL DATA COMUNICACIONES C.A.",
      "id": "indicator--7fc924b2-45b4-46d7-8cc3-694e428077a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.41.168.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T19:06:37.817Z",
      "x_nadsec_last_seen": "2026-05-06T19:08:44.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269820"
      ],
      "x_nadsec_orgs": [
        "FULL DATA COMUNICACIONES C.A."
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7c7abf33-9d98-458c-85c3-2f0c326afcd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T19:29:02.154Z",
      "x_nadsec_last_seen": "2026-05-06T19:29:02.792Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T19:55:31.913Z",
      "x_nadsec_last_seen": "2026-05-15T01:31:20.925Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50477; asn_org=Svyaz-Energo Ltd.",
      "id": "indicator--01949524-5c85-4882-bcd9-f11ad5eb2b83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.149.207.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T19:10:14.216Z",
      "x_nadsec_last_seen": "2026-05-06T19:12:21.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50477"
      ],
      "x_nadsec_orgs": [
        "Svyaz-Energo Ltd."
      ]
    },
    {
      "created": "2026-05-06T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T20:05:10.000Z",
      "valid_until": "2026-06-07T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T19:19:11.848Z",
      "x_nadsec_last_seen": "2026-05-18T13:46:48.022Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=62044; asn_org=Zscaler Switzerland GmbH",
      "id": "indicator--96fd1c07-3fdb-42d6-9bff-3c501baf11b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.85.0.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T20:09:16.274Z",
      "x_nadsec_last_seen": "2026-05-06T20:11:22.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "62044"
      ],
      "x_nadsec_orgs": [
        "Zscaler Switzerland GmbH"
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=49125; asn_org=Uteam LTD; user(top)=**",
      "id": "indicator--a906beff-b9db-47e3-9327-141500013b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.117.184.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T20:45:27.112Z",
      "x_nadsec_last_seen": "2026-05-06T20:45:27.112Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "49125"
      ],
      "x_nadsec_orgs": [
        "Uteam LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--cfa835ce-812c-442b-afdf-fcffa04c212e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.189.240.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T20:13:52.234Z",
      "x_nadsec_last_seen": "2026-05-06T20:21:45.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b147e083-66f3-4b3d-a021-7babab29af87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.113.128.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T20:54:02.813Z",
      "x_nadsec_last_seen": "2026-05-06T20:56:11.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ade72f7d-271b-4562-832d-22ff70178e52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T20:21:56.398Z",
      "x_nadsec_last_seen": "2026-05-14T04:16:34.778Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28126; asn_org=BRISANET SERVICOS DE TELECOMUNICACOES S.A; user(top)=**",
      "id": "indicator--79e41f05-b89c-44d4-ba56-b9e687b09eb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.42.21.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T20:10:34.980Z",
      "x_nadsec_last_seen": "2026-05-06T20:10:34.980Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28126"
      ],
      "x_nadsec_orgs": [
        "BRISANET SERVICOS DE TELECOMUNICACOES S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28656; asn_org=BTT TELECOMUNICACOES S.A.",
      "id": "indicator--8914d111-4ac1-4d0b-a3c0-d5cc50e84bab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.190.118.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T20:38:57.582Z",
      "x_nadsec_last_seen": "2026-05-06T20:38:57.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28656"
      ],
      "x_nadsec_orgs": [
        "BTT TELECOMUNICACOES S.A."
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--131b91ad-9ca6-4daf-bb4f-0faad70bb263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.36.200.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T20:30:15.185Z",
      "x_nadsec_last_seen": "2026-05-06T20:32:21.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5730b215-9326-41d1-8a0b-8eb419d92580",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T20:58:50.342Z",
      "x_nadsec_last_seen": "2026-05-06T20:58:50.342Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-06T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--fec1ce6f-e6fc-4335-ad64-3e80c3da5fd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:05:10.000Z",
      "valid_until": "2026-06-07T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T20:58:40.022Z",
      "x_nadsec_last_seen": "2026-05-06T20:58:40.022Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-06T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--4fee598d-3219-44cf-b7fb-b970980ae157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.148.5.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T22:05:10.000Z",
      "valid_until": "2026-06-07T22:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T21:47:38.238Z",
      "x_nadsec_last_seen": "2026-05-06T21:54:12.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-05-06T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--9b78cb97-9204-43f6-b635-430089279553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.147.137.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T22:05:10.000Z",
      "valid_until": "2026-06-07T22:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-06T21:18:42.286Z",
      "x_nadsec_last_seen": "2026-05-20T11:30:23.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--02cb716d-9f53-4192-89f2-d1dc6eef00f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:05:10.000Z",
      "valid_until": "2026-06-07T23:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-06T22:41:43.139Z",
      "x_nadsec_last_seen": "2026-05-22T19:16:03.489Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--cbdd72fd-4754-4597-9e20-c1e0d0223514",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.189.240.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:05:10.000Z",
      "valid_until": "2026-06-07T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T22:14:06.104Z",
      "x_nadsec_last_seen": "2026-05-06T22:16:11.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=ER; asn=19318; asn_org=Interserver, Inc",
      "id": "indicator--20fdcd5b-8c3b-4895-8230-00e06d6ba4bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.239.151.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:05:10.000Z",
      "valid_until": "2026-06-07T23:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-06T22:24:07.585Z",
      "x_nadsec_last_seen": "2026-05-30T19:49:42.511Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "ER"
      ],
      "x_nadsec_asns": [
        "19318"
      ],
      "x_nadsec_orgs": [
        "Interserver, Inc"
      ]
    },
    {
      "created": "2026-05-06T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a4bcfa92-0d36-44eb-87a5-a7d7ae372273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-06T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '90.150.252.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T23:05:10.000Z",
      "valid_until": "2026-06-07T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T22:31:24.682Z",
      "x_nadsec_last_seen": "2026-05-06T22:39:11.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CA; asn=5645; asn_org=TekSavvy Solutions, Inc.",
      "id": "indicator--ea49e45b-928e-4596-b30d-af99c0f35a39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.195.198.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-06T23:37:07.576Z",
      "x_nadsec_last_seen": "2026-05-06T23:43:51.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "5645"
      ],
      "x_nadsec_orgs": [
        "TekSavvy Solutions, Inc."
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4894ce38-4955-4701-82ef-55c6e78d9f5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.66.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T23:40:40.790Z",
      "x_nadsec_last_seen": "2026-05-06T23:40:43.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--f4800271-ae2a-49e5-b91f-06fcf49c6a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T00:03:53.634Z",
      "x_nadsec_last_seen": "2026-05-29T09:09:53.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=43350; asn_org=NForce Entertainment B.V.",
      "id": "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.107.80.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-06T23:21:39.771Z",
      "x_nadsec_last_seen": "2026-05-31T07:15:04.164Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "43350"
      ],
      "x_nadsec_orgs": [
        "NForce Entertainment B.V."
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d81a8565-9202-4f55-8ac8-3f4b40d2702e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.188.116.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T23:26:35.804Z",
      "x_nadsec_last_seen": "2026-05-06T23:33:29.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--36af7792-e9c4-4a3b-810b-d35bb44d383a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.251.113.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T23:31:23.062Z",
      "x_nadsec_last_seen": "2026-05-06T23:31:23.062Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--7a51bd85-2a95-4d35-a22d-6fcd7a79c682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.24.128.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T23:06:17.906Z",
      "x_nadsec_last_seen": "2026-05-06T23:08:24.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b2690d8f-69a6-4c83-af07-dd28aa67925e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.192.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-06T23:58:28.391Z",
      "x_nadsec_last_seen": "2026-05-06T23:58:38.742Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--92ff04ab-3609-4760-9793-9da9a52fb2e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T23:49:44.736Z",
      "x_nadsec_last_seen": "2026-05-06T23:49:44.736Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--c317f5d7-ab95-4320-a10b-36b4b51e4c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.205.166.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T00:05:10.000Z",
      "valid_until": "2026-06-08T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-06T23:53:30.026Z",
      "x_nadsec_last_seen": "2026-05-06T23:53:30.026Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--37e51044-f71f-475f-91a3-11d5ce816cab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.158.79.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:05:10.000Z",
      "valid_until": "2026-06-08T01:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T00:17:56.466Z",
      "x_nadsec_last_seen": "2026-05-07T00:24:25.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-07T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e8032cb7-eeea-4fd5-bba2-21cc9403d0d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.40.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:05:10.000Z",
      "valid_until": "2026-06-08T01:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T00:47:36.745Z",
      "x_nadsec_last_seen": "2026-05-21T05:42:49.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-07T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e6ed7cf3-abf8-4540-a9d2-7088ad7ecce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.16.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:05:10.000Z",
      "valid_until": "2026-06-08T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T00:47:06.669Z",
      "x_nadsec_last_seen": "2026-05-07T00:47:06.669Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--1605e60d-63e1-4f8b-96d9-0b01cc414e46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.171.19.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:05:10.000Z",
      "valid_until": "2026-06-08T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T00:56:10.362Z",
      "x_nadsec_last_seen": "2026-05-07T00:56:10.362Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-07T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--278100d7-42f3-4bf8-b47e-fd9341f39119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:05:10.000Z",
      "valid_until": "2026-06-08T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T00:34:02.622Z",
      "x_nadsec_last_seen": "2026-05-14T23:34:49.227Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.192.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:05:10.000Z",
      "valid_until": "2026-06-08T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T00:37:35.007Z",
      "x_nadsec_last_seen": "2026-05-11T03:28:27.266Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-07T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--464ae9ed-cc40-491b-8284-bc8b0a2c2bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:05:10.000Z",
      "valid_until": "2026-06-08T01:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T00:34:27.174Z",
      "x_nadsec_last_seen": "2026-05-16T14:33:15.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4b6ecdb7-d289-4871-ba36-1262b9961285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.34.174.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T01:38:50.428Z",
      "x_nadsec_last_seen": "2026-05-07T01:41:52.990Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--eb3347b9-3b27-4ee0-8053-2c9a4dbfb813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.238.194.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T01:09:28.404Z",
      "x_nadsec_last_seen": "2026-05-07T01:11:33.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6fb3c7a1-1e5c-43d8-b424-06cdc2669500",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.178.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T01:13:28.787Z",
      "x_nadsec_last_seen": "2026-05-07T01:13:28.787Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--515b620c-42c2-485c-bb7f-13bdfd7ec9df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.151.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T01:13:36.195Z",
      "x_nadsec_last_seen": "2026-05-07T01:13:37.280Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=pptpd; ports=1723; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T01:19:35.834Z",
      "x_nadsec_last_seen": "2026-05-07T01:20:13.522Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=AM; asn=197834; asn_org=Ucom CJSC",
      "id": "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.32.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-07T01:47:22.401Z",
      "x_nadsec_last_seen": "2026-05-28T19:45:12.663Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "197834"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=29075; asn_org=Ielo-liazo Services SAS",
      "id": "indicator--85992268-45ee-4a73-a049-b97ad20101d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.177.180.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T01:13:36.078Z",
      "x_nadsec_last_seen": "2026-05-07T01:15:42.391Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "29075"
      ],
      "x_nadsec_orgs": [
        "Ielo-liazo Services SAS"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cf25f12d-806b-4f37-b197-83cdda527300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.7.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T01:29:06.853Z",
      "x_nadsec_last_seen": "2026-05-07T01:29:06.853Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--255a5255-b062-4ccd-be5b-de7504ecf6d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T01:50:05.963Z",
      "x_nadsec_last_seen": "2026-05-14T10:02:45.573Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4eaadb8b-0f1e-4df7-88b7-dcfa018e8ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.235.157.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-07T01:52:22.926Z",
      "x_nadsec_last_seen": "2026-05-08T04:56:34.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--af219a32-2cdc-4738-898e-2c071c8dc024",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.198.144.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T01:48:48.122Z",
      "x_nadsec_last_seen": "2026-05-07T01:48:48.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--90297225-30cf-41de-98f6-f07ac0de4ec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.27.44.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T01:21:19.232Z",
      "x_nadsec_last_seen": "2026-05-07T01:28:55.167Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--4c479bd0-99ab-4787-939c-c27603308da2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T01:16:26.501Z",
      "x_nadsec_last_seen": "2026-05-07T14:38:49.119Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--cfddc57c-0ca0-4ca6-8f89-09c8b2ab8f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T01:55:03.946Z",
      "x_nadsec_last_seen": "2026-05-07T01:55:03.946Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8905; asn_org=Digit One LLC",
      "id": "indicator--8df5af37-5eee-4764-add0-544dc9ab1988",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.89.186.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:05:10.000Z",
      "valid_until": "2026-06-08T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T01:12:55.425Z",
      "x_nadsec_last_seen": "2026-05-07T01:15:01.542Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8905"
      ],
      "x_nadsec_orgs": [
        "Digit One LLC"
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.28.191.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T02:41:56.333Z",
      "x_nadsec_last_seen": "2026-05-07T02:41:56.333Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a5ca3cff-4d90-4d6b-858b-6cf83799b131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.160.144.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T02:35:53.339Z",
      "x_nadsec_last_seen": "2026-05-07T02:35:58.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9dccdd5c-6537-43f2-a60c-c530277cd60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.225.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T02:59:05.330Z",
      "x_nadsec_last_seen": "2026-05-07T02:59:16.633Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=2514; asn_org=NTT PC Communications, Inc.",
      "id": "indicator--5bac5300-4b4b-444d-919b-6d2f7a7e1098",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.120.0.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-05-07T02:47:29.113Z",
      "x_nadsec_last_seen": "2026-05-27T06:12:08.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2514"
      ],
      "x_nadsec_orgs": [
        "NTT PC Communications, Inc."
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--953f0d0e-bcce-45e5-9ac6-5244c658b696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.72.107.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T02:14:43.562Z",
      "x_nadsec_last_seen": "2026-05-07T02:21:13.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--baa0659c-1658-4faf-9833-d606ad844fd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.165.159.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T02:14:06.493Z",
      "x_nadsec_last_seen": "2026-05-07T02:54:27.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--88f0300a-34eb-4e9c-a645-94090fedb9e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.136.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T02:18:46.412Z",
      "x_nadsec_last_seen": "2026-05-07T02:18:56.733Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f0df9278-d605-4a87-be59-567ad0776013",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.184.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T02:59:12.631Z",
      "x_nadsec_last_seen": "2026-05-07T02:59:12.631Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--20568455-d2c3-4806-92c9-9485f7ea7ff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.206.156.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T02:30:35.193Z",
      "x_nadsec_last_seen": "2026-05-07T02:53:35.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-07T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:05:11.000Z",
      "valid_until": "2026-06-08T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T02:34:36.159Z",
      "x_nadsec_last_seen": "2026-05-18T16:33:45.538Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--aa4c3198-7298-43c8-b1dc-c4b0cca2d5a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T03:08:12.548Z",
      "x_nadsec_last_seen": "2026-05-07T03:08:12.548Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--a913cd07-de21-458e-b41c-be0740b24906",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.73.90.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T03:35:04.018Z",
      "x_nadsec_last_seen": "2026-05-07T03:41:31.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7ebc6322-452a-410c-ae99-a6cd506eb5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T03:06:53.048Z",
      "x_nadsec_last_seen": "2026-05-24T07:11:19.412Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f6f0e415-b2c6-45e1-928b-50014b696384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T03:06:53.296Z",
      "x_nadsec_last_seen": "2026-05-07T03:06:53.296Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=24435; asn_org=Supernet Limited Transit Autonomous System Number",
      "id": "indicator--7f0e6170-7096-472c-a352-4b1355709338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.130.24.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T03:18:11.415Z",
      "x_nadsec_last_seen": "2026-05-07T03:20:16.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "24435"
      ],
      "x_nadsec_orgs": [
        "Supernet Limited Transit Autonomous System Number"
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T03:32:12.100Z",
      "x_nadsec_last_seen": "2026-05-10T01:07:14.179Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9326213f-5895-4184-bab1-cc7cbe4ac0c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.74.134.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T03:08:30.272Z",
      "x_nadsec_last_seen": "2026-05-07T03:10:35.297Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:05:10.000Z",
      "valid_until": "2026-06-08T04:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-07T03:31:45.143Z",
      "x_nadsec_last_seen": "2026-05-31T15:08:09.177Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1883",
        "3306",
        "21",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mqttd",
        "mysqld",
        "epmapper",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--0170691f-90da-4638-98e5-40f47a33e846",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.160.249.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T04:07:40.156Z",
      "x_nadsec_last_seen": "2026-05-07T04:09:45.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--34364df4-4f7f-4cdf-9dc3-71931343f705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T04:27:45.777Z",
      "x_nadsec_last_seen": "2026-05-07T05:29:50.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--9ac952f4-9bf2-4b22-a709-97ca9d0b868c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.188.91.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T04:49:48.045Z",
      "x_nadsec_last_seen": "2026-05-07T04:56:49.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--68c62d3a-5f5f-4480-9258-ee069450fa84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.147.171.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T04:52:26.407Z",
      "x_nadsec_last_seen": "2026-05-29T16:38:12.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--995982d0-4547-42c0-a5d8-44c27ca58eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.156.78.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T04:53:58.067Z",
      "x_nadsec_last_seen": "2026-05-07T04:56:04.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6e717009-6896-41fe-aca8-1dceff0ab02f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.72.107.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T04:29:43.920Z",
      "x_nadsec_last_seen": "2026-05-07T04:30:09.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--0444e682-5311-4995-91b8-9218f315847b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.216.195.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-07T04:24:59.703Z",
      "x_nadsec_last_seen": "2026-05-28T04:35:11.039Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--969eecad-1dcc-4452-8198-6ad8aedbccdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.180.137.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T04:13:17.579Z",
      "x_nadsec_last_seen": "2026-05-07T04:13:18.271Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:05:05.000Z",
      "valid_until": "2026-06-08T05:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T04:47:23.359Z",
      "x_nadsec_last_seen": "2026-05-25T18:13:35.579Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133676; asn_org=Precious netcom pvt ltd",
      "id": "indicator--75214ed9-875c-4b71-b307-05d7b1a61e3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.212.139.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T05:44:27.239Z",
      "x_nadsec_last_seen": "2026-05-08T05:33:47.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133676"
      ],
      "x_nadsec_orgs": [
        "Precious netcom pvt ltd"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--889361b3-2d4e-4289-a366-069f4c0a5918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.0.133.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T05:49:00.772Z",
      "x_nadsec_last_seen": "2026-05-07T05:51:05.510Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ca263206-f0c5-40dd-ba40-f86009ca4a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.56.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-07T05:39:18.764Z",
      "x_nadsec_last_seen": "2026-05-07T05:40:02.863Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--86864448-8651-44c5-af32-da55aa8cc31c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T05:24:49.884Z",
      "x_nadsec_last_seen": "2026-05-13T17:23:32.879Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--7bdaaf2a-ad82-4be3-8b24-97c07ecbf776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.244.186.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T06:01:20.440Z",
      "x_nadsec_last_seen": "2026-05-07T06:03:25.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--4f2570ca-9024-4588-9971-fb410942222c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.253.38.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T05:52:18.456Z",
      "x_nadsec_last_seen": "2026-05-07T05:54:23.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EC; asn=14522; asn_org=SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC",
      "id": "indicator--a538dd26-5d9d-4469-9737-9b2dcd4934aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.10.164.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T05:49:56.929Z",
      "x_nadsec_last_seen": "2026-05-07T05:49:57.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "14522"
      ],
      "x_nadsec_orgs": [
        "SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50187; asn_org=BaikalWestCom",
      "id": "indicator--6d9dd2f9-0e07-4e94-9d97-1ba9663792fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.44.247.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T06:00:43.520Z",
      "x_nadsec_last_seen": "2026-05-07T09:35:15.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50187"
      ],
      "x_nadsec_orgs": [
        "BaikalWestCom"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a80d64a8-7d82-40fc-8594-46ccbc108ba4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.34.178.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T05:07:42.928Z",
      "x_nadsec_last_seen": "2026-05-22T16:53:46.283Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dabb26a4-c668-4593-aabf-a62c2d5c5fe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T05:32:09.634Z",
      "x_nadsec_last_seen": "2026-05-07T05:32:10.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=269656; asn_org=RK Telecom Provedor Internet LTDA",
      "id": "indicator--7a4f05af-9d6b-414c-a1c3-1b1253195568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.190.249.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T05:29:38.020Z",
      "x_nadsec_last_seen": "2026-05-07T05:31:44.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "269656"
      ],
      "x_nadsec_orgs": [
        "RK Telecom Provedor Internet LTDA"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--f20a8ecd-1e0c-43b2-afb1-9907fd6b80c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.187.92.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T05:11:41.299Z",
      "x_nadsec_last_seen": "2026-05-07T05:18:53.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--5414692c-cf7f-47d0-a618-fd8ea083439e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.89.73.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T05:14:57.604Z",
      "x_nadsec_last_seen": "2026-05-07T05:17:02.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=56300; asn_org=MyRepublic Ltd.; user(top)=**",
      "id": "indicator--f12e98f8-34cf-4bcf-a160-d92e1a342851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.96.195.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T05:37:55.835Z",
      "x_nadsec_last_seen": "2026-05-07T05:37:55.835Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "56300"
      ],
      "x_nadsec_orgs": [
        "MyRepublic Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--3568545d-7715-4e59-90c4-e501c4be975c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T05:19:16.138Z",
      "x_nadsec_last_seen": "2026-05-12T06:49:11.910Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-05-07T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--2e36aaad-18c6-4abf-a731-9e14a666c652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:05:11.000Z",
      "valid_until": "2026-06-08T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T05:57:58.117Z",
      "x_nadsec_last_seen": "2026-05-07T06:05:20.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--929060f2-3392-4a6f-b2d6-e982da1a5e71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.165.128.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-07T06:44:34.145Z",
      "x_nadsec_last_seen": "2026-05-23T14:31:51.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d2fd97f1-bd4d-4e1c-8052-62de0f5cc92e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.165.165.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T06:26:37.843Z",
      "x_nadsec_last_seen": "2026-05-07T06:33:09.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d1c87165-4326-400f-89f5-cebf0d3d8628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.167.204.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T06:46:40.210Z",
      "x_nadsec_last_seen": "2026-05-07T06:53:05.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--3bef5794-190b-453f-b4d6-16a25b28f1e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.37.253.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T06:19:13.142Z",
      "x_nadsec_last_seen": "2026-05-07T06:21:20.133Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--d9e45cb9-e8f4-4cc1-9b9c-920c203e7ea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.126.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T06:52:12.484Z",
      "x_nadsec_last_seen": "2026-05-07T06:54:17.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6168a1f4-822e-47c8-bb50-13644d56b26b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.207.150.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T06:36:15.372Z",
      "x_nadsec_last_seen": "2026-05-07T06:57:23.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cdc8d0c4-7be2-417e-b9a4-8f133735a2d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.116.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T06:49:24.529Z",
      "x_nadsec_last_seen": "2026-05-07T06:49:24.529Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--32de6b81-33e0-4ad6-935e-ea87f5a740da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.174.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-07T06:56:08.348Z",
      "x_nadsec_last_seen": "2026-05-07T06:57:10.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=263661; asn_org=BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO",
      "id": "indicator--a502c5ee-e751-46d6-ac52-714527dd8a11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.221.59.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T06:16:46.924Z",
      "x_nadsec_last_seen": "2026-05-10T22:57:35.732Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263661"
      ],
      "x_nadsec_orgs": [
        "BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BO; asn=25620; asn_org=COTAS LTDA.",
      "id": "indicator--d27297d1-54b9-4d02-a075-0f0ede4ae68c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.186.21.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T06:49:29.395Z",
      "x_nadsec_last_seen": "2026-05-07T06:56:47.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "25620"
      ],
      "x_nadsec_orgs": [
        "COTAS LTDA."
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--954cfbf2-a1a1-46f6-825b-8d4e3777627b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.45.5.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-07T06:21:33.455Z",
      "x_nadsec_last_seen": "2026-05-07T07:23:36.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=NL; asn=49981; asn_org=WorldStream B.V.",
      "id": "indicator--d91cab75-0329-402c-93ab-ac2bf99b39a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.8.252.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 39,
      "x_nadsec_first_seen": "2026-05-07T06:06:18.552Z",
      "x_nadsec_last_seen": "2026-05-17T21:24:04.144Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49981"
      ],
      "x_nadsec_orgs": [
        "WorldStream B.V."
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=151707; asn_org=Ethen Teleinfra Private Limited",
      "id": "indicator--02df94ea-d4a7-4751-ba8e-d9fe93859b3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.124.65.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T06:51:54.720Z",
      "x_nadsec_last_seen": "2026-05-07T06:51:54.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151707"
      ],
      "x_nadsec_orgs": [
        "Ethen Teleinfra Private Limited"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--b8cc6065-c1f6-4ce2-a438-11245e76d756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.71.220.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-07T07:03:37.411Z",
      "x_nadsec_last_seen": "2026-05-07T07:03:45.428Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CH; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--644ea726-41b3-4ddb-afa9-120c81d7c42b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.59.124.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T06:29:24.192Z",
      "x_nadsec_last_seen": "2026-05-07T06:36:22.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T06:50:33.153Z",
      "x_nadsec_last_seen": "2026-05-15T12:48:35.410Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--e61dd399-12d0-4e0c-ac0f-e5b9c9e4380d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.255.36.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T06:30:32.073Z",
      "x_nadsec_last_seen": "2026-05-07T06:32:38.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-07T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--15f20a79-1225-4330-ab36-8ec6b82f24d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.96.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:05:10.000Z",
      "valid_until": "2026-06-08T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T06:44:14.512Z",
      "x_nadsec_last_seen": "2026-05-07T06:44:14.512Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--c88d6bb2-0a01-4350-a764-18d12e52630f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.214.130.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T07:15:21.246Z",
      "x_nadsec_last_seen": "2026-05-07T07:15:25.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--f886ec11-5e68-4312-9b08-e904371be295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.183.237.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T07:55:29.329Z",
      "x_nadsec_last_seen": "2026-05-07T08:58:52.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=23860; asn_org=Alliance Broadband Services Pvt. Ltd.",
      "id": "indicator--00fcd0ce-0ebb-46aa-b858-855be5d6df08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.107.212.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T07:57:17.778Z",
      "x_nadsec_last_seen": "2026-05-14T05:54:02.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "23860"
      ],
      "x_nadsec_orgs": [
        "Alliance Broadband Services Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a10b7c45-890a-4d61-9c79-e1bf6c1eac17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.214.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T07:32:49.820Z",
      "x_nadsec_last_seen": "2026-05-07T07:32:49.820Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25227; asn_org=JSC Avantel",
      "id": "indicator--627ebdbe-c861-426a-a7e2-a61156fe5793",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.55.172.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T07:25:05.514Z",
      "x_nadsec_last_seen": "2026-05-07T07:27:10.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25227"
      ],
      "x_nadsec_orgs": [
        "JSC Avantel"
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b181a300-9436-4c0f-980d-23f9032f61da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.22.245.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T07:31:53.701Z",
      "x_nadsec_last_seen": "2026-05-07T07:32:08.044Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--0baa6b41-401e-47ad-bbe3-2928e7a9d3f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.132.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T07:31:14.396Z",
      "x_nadsec_last_seen": "2026-05-07T07:31:14.396Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.192.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T07:47:51.529Z",
      "x_nadsec_last_seen": "2026-05-07T07:48:17.991Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T07:31:58.259Z",
      "x_nadsec_last_seen": "2026-05-25T11:31:09.005Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--d39d2809-384a-480c-93c3-482ebff31559",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.7.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:05:10.000Z",
      "valid_until": "2026-06-08T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T07:39:21.550Z",
      "x_nadsec_last_seen": "2026-05-07T07:39:45.324Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=266647; asn_org=I360 Solucoes para Interacao e Com. Corp. Ltda",
      "id": "indicator--4d0121f3-73e5-4a07-ba12-faf0f8313983",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.201.164.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T08:24:42.658Z",
      "x_nadsec_last_seen": "2026-05-07T08:26:49.248Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266647"
      ],
      "x_nadsec_orgs": [
        "I360 Solucoes para Interacao e Com. Corp. Ltda"
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--3f3f8f8f-4abd-4290-82f7-320f257eb464",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T08:12:17.580Z",
      "x_nadsec_last_seen": "2026-05-07T08:14:25.116Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--122aa64d-3b70-4eef-9186-e7c720beb7b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.245.126.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T08:30:13.162Z",
      "x_nadsec_last_seen": "2026-05-07T08:36:44.061Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8f27efd5-1455-44bc-8932-36fd3b38b7d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.63.251.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T09:03:50.210Z",
      "x_nadsec_last_seen": "2026-05-07T09:09:39.902Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T08:47:37.023Z",
      "x_nadsec_last_seen": "2026-05-07T08:47:37.023Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--82141df0-26d2-47ea-8856-f863d5cd980f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.107.16.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T08:24:39.424Z",
      "x_nadsec_last_seen": "2026-05-07T08:26:46.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3a5c4bff-63fa-4134-8d3e-0731f1ba8a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T08:21:43.060Z",
      "x_nadsec_last_seen": "2026-05-23T04:30:30.129Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--f400af7f-72aa-4946-a704-e8443a9a80eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.7.192.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-07T08:32:29.029Z",
      "x_nadsec_last_seen": "2026-05-26T09:05:52.454Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company",
      "id": "indicator--707de3ae-33a3-4639-9313-ce120b6815c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.137.224.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T08:55:35.519Z",
      "x_nadsec_last_seen": "2026-05-07T08:57:42.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ]
    },
    {
      "created": "2026-05-07T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--d4da6fde-3d0b-4975-a625-eacab734b7ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.161.219.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:05:10.000Z",
      "valid_until": "2026-06-08T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T08:22:53.479Z",
      "x_nadsec_last_seen": "2026-05-07T08:25:00.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23694; asn_org=PT Iconmedia Lintas Nusantara",
      "id": "indicator--ff939cb4-35ad-4719-833b-ea5a048e24c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.66.46.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T09:44:15.455Z",
      "x_nadsec_last_seen": "2026-05-07T09:46:19.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23694"
      ],
      "x_nadsec_orgs": [
        "PT Iconmedia Lintas Nusantara"
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--676b5a43-67ce-464d-b368-b0914d21142b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.227.188.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T09:55:45.488Z",
      "x_nadsec_last_seen": "2026-05-21T07:37:31.881Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--0e7fc390-53d2-4080-8c1c-ac200b613eb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.255.253.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T09:56:27.049Z",
      "x_nadsec_last_seen": "2026-05-07T09:56:32.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=CA; asn=852; asn_org=TELUS Communications",
      "id": "indicator--da43b753-cd24-47af-9326-3065eb1c377a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '207.134.248.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T09:33:31.903Z",
      "x_nadsec_last_seen": "2026-05-07T09:53:45.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "852"
      ],
      "x_nadsec_orgs": [
        "TELUS Communications"
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=212219; asn_org=Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi; user(top)=**",
      "id": "indicator--0273fc5c-8ad8-4350-8978-6022d9252c0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.140.242.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T09:33:34.499Z",
      "x_nadsec_last_seen": "2026-05-07T09:33:34.499Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "212219"
      ],
      "x_nadsec_orgs": [
        "Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--a73b983b-00ce-46c7-b735-fae75ae24f3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.48.176.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T10:01:26.635Z",
      "x_nadsec_last_seen": "2026-05-07T10:03:32.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1ed6e900-51c6-40c2-b695-13d86f43f3bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T09:56:29.175Z",
      "x_nadsec_last_seen": "2026-05-22T09:11:51.104Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=39353; asn_org=Gobierno del Principado de Asturias",
      "id": "indicator--c7b21013-b1ae-4fec-a265-c0f47af84a98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.151.19.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:05:10.000Z",
      "valid_until": "2026-06-08T10:05:08.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-05-07T09:39:29.658Z",
      "x_nadsec_last_seen": "2026-05-15T16:39:58.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "39353"
      ],
      "x_nadsec_orgs": [
        "Gobierno del Principado de Asturias"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ae768871-1162-41cb-8b53-014c3caefe01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.34.189.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T11:04:45.283Z",
      "x_nadsec_last_seen": "2026-05-14T11:04:32.389Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d1be2d62-4093-4637-828f-dabff3a7fdfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.222.40.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T10:52:57.912Z",
      "x_nadsec_last_seen": "2026-05-07T10:52:58.312Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--15ae6434-1b14-4849-b371-43eebca25326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.252.41.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T10:57:24.461Z",
      "x_nadsec_last_seen": "2026-05-07T10:59:29.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--d99b5f9a-f339-4271-abd4-600aad94c40b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T10:51:56.311Z",
      "x_nadsec_last_seen": "2026-05-07T10:51:56.311Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=10620; asn_org=Telmex Colombia S.A.",
      "id": "indicator--613aab0f-7ee2-4a56-9bc4-486f5d90dc1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.55.22.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T10:06:34.581Z",
      "x_nadsec_last_seen": "2026-05-07T10:13:29.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "10620"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--5866bd32-4d63-41e2-b40f-ee9355ab00a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.136.63.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T10:18:37.525Z",
      "x_nadsec_last_seen": "2026-05-07T10:18:37.633Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--0c05723e-93ae-4459-af69-e715a7305629",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.195.226.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T10:08:22.367Z",
      "x_nadsec_last_seen": "2026-05-07T10:12:50.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JP; asn=7672; asn_org=Hokuden Information System Service Co.,Ltd.",
      "id": "indicator--3cda96d9-55ee-42f4-b948-33fbc734717a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.171.212.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T10:16:54.127Z",
      "x_nadsec_last_seen": "2026-05-07T10:16:54.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "7672"
      ],
      "x_nadsec_orgs": [
        "Hokuden Information System Service Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=49345; asn_org=Beeonline Ojsc",
      "id": "indicator--eaba8bb6-4583-4c5c-aac6-98e60234311b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.171.1.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T10:21:23.659Z",
      "x_nadsec_last_seen": "2026-05-07T10:23:30.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "49345"
      ],
      "x_nadsec_orgs": [
        "Beeonline Ojsc"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--31c20683-c975-4d2b-8387-803b78661891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.35.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T11:00:15.986Z",
      "x_nadsec_last_seen": "2026-05-07T11:00:15.986Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--6f34328d-9c0a-4798-912a-9f6a4c9a4a69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.218.254.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T10:21:26.805Z",
      "x_nadsec_last_seen": "2026-05-07T10:21:26.805Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.181.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-07T10:45:43.155Z",
      "x_nadsec_last_seen": "2026-05-07T10:49:07.309Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T10:41:48.312Z",
      "x_nadsec_last_seen": "2026-05-14T15:31:51.553Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a911eb18-35eb-45f6-ab54-a02c4a58225e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.188.9.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:05:10.000Z",
      "valid_until": "2026-06-08T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T10:37:20.996Z",
      "x_nadsec_last_seen": "2026-05-07T10:39:28.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--9c1f9fb0-5998-4e97-8323-61a801173b59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.80.210.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T11:16:53.619Z",
      "x_nadsec_last_seen": "2026-05-07T11:19:00.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--565193be-3c56-4842-9489-103313cc04a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.189.27.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T11:58:35.998Z",
      "x_nadsec_last_seen": "2026-05-07T11:58:36.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mqttd; ports=1883; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--07d01aee-8e9f-4cf3-a732-2d8abc21466f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T11:25:43.063Z",
      "x_nadsec_last_seen": "2026-05-07T11:26:12.566Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--f2b11d00-e20e-4471-90fa-27af0db5cf64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.16.172.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T11:19:25.025Z",
      "x_nadsec_last_seen": "2026-05-07T11:21:32.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--b71c1d3e-c63b-49a3-968f-eecceb352859",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.53.15.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T11:51:00.998Z",
      "x_nadsec_last_seen": "2026-05-07T11:53:04.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--bc759b4c-891f-4fbb-84a7-a50ef98e989d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.205.52.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T11:50:14.143Z",
      "x_nadsec_last_seen": "2026-05-25T22:17:25.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--37a9df55-5e14-4c16-8a6e-f538dd931289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.134.194.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T11:41:31.652Z",
      "x_nadsec_last_seen": "2026-05-13T22:03:23.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-05-07T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--e80c508d-3e25-4c7d-9299-71405aa62560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.10.57.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:05:04.000Z",
      "valid_until": "2026-06-08T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T11:25:57.690Z",
      "x_nadsec_last_seen": "2026-05-07T11:28:04.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-07T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=43661; asn_org=OOO Kip Konnect",
      "id": "indicator--218b7482-b059-4b6c-8ccf-93c33577a45d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.95.120.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:05:10.000Z",
      "valid_until": "2026-06-08T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T12:22:30.187Z",
      "x_nadsec_last_seen": "2026-05-07T12:24:36.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43661"
      ],
      "x_nadsec_orgs": [
        "OOO Kip Konnect"
      ]
    },
    {
      "created": "2026-05-07T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28126; asn_org=BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "id": "indicator--e1e1c7b2-ae71-4c67-ab3c-edbf870691b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.37.165.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:05:10.000Z",
      "valid_until": "2026-06-08T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T12:29:17.010Z",
      "x_nadsec_last_seen": "2026-05-07T12:31:23.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28126"
      ],
      "x_nadsec_orgs": [
        "BRISANET SERVICOS DE TELECOMUNICACOES S.A"
      ]
    },
    {
      "created": "2026-05-07T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--2826e72f-737e-485f-be0a-f8ad382f5358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.171.111.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:05:10.000Z",
      "valid_until": "2026-06-08T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T13:03:22.237Z",
      "x_nadsec_last_seen": "2026-05-07T13:05:33.719Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-07T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=264758; asn_org=ISP GROUP SRL",
      "id": "indicator--bb2868e6-5709-4531-aeb0-2bb514121fdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.173.213.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:05:10.000Z",
      "valid_until": "2026-06-08T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T12:52:33.915Z",
      "x_nadsec_last_seen": "2026-05-07T13:00:16.577Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "264758"
      ],
      "x_nadsec_orgs": [
        "ISP GROUP SRL"
      ]
    },
    {
      "created": "2026-05-07T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--94a17d3a-e1f1-48ae-9b9b-ccd3a781a501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:05:10.000Z",
      "valid_until": "2026-06-08T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T12:52:30.364Z",
      "x_nadsec_last_seen": "2026-05-24T13:06:06.192Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c369ef7b-4eeb-48ee-ad4f-9145d8165216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.0.206.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:05:10.000Z",
      "valid_until": "2026-06-08T13:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T12:35:03.815Z",
      "x_nadsec_last_seen": "2026-05-14T05:51:40.219Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--17a0c170-bddb-443a-b417-050952d9e2fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.228.73.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-05-07T13:58:04.855Z",
      "x_nadsec_last_seen": "2026-05-07T14:01:51.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5151c88e-fde9-4fc1-8fac-7de6d835fdb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.70.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T14:01:17.230Z",
      "x_nadsec_last_seen": "2026-05-07T14:03:21.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--189c5b32-8cf9-47ba-94d8-0c84f101bc4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.118.58.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T13:10:29.668Z",
      "x_nadsec_last_seen": "2026-05-07T13:12:41.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--9f68e0d0-d947-4150-88e0-a70649467e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-07T13:27:17.883Z",
      "x_nadsec_last_seen": "2026-05-24T06:30:55.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--ab313e85-db08-4ab8-8ca2-9079542b987b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.179.236.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T13:33:17.302Z",
      "x_nadsec_last_seen": "2026-05-07T13:35:23.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--b933a317-3678-4f88-9822-2bfa70680431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T13:16:41.883Z",
      "x_nadsec_last_seen": "2026-05-23T21:23:32.873Z",
      "x_nadsec_ports": [
        "21",
        "1433",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=I*****@",
      "id": "indicator--2e1e9009-760a-4e8c-83e9-cc2130b712ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.253.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T14:01:49.031Z",
      "x_nadsec_last_seen": "2026-05-07T14:02:21.609Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9aa6efda-8576-4cd0-8f73-ef70241b1303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.187.53.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T14:01:46.485Z",
      "x_nadsec_last_seen": "2026-05-07T14:01:46.485Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--9e7ee3e3-34fa-4a15-8339-ad80289d68d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T13:06:46.088Z",
      "x_nadsec_last_seen": "2026-05-07T13:06:46.088Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--c39c9958-639a-4dc3-a403-35f3916d7610",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.99.134.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T13:14:45.777Z",
      "x_nadsec_last_seen": "2026-05-21T00:20:29.602Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--dcede044-0de9-4d5f-a580-1ae9f9adb0ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T13:16:45.456Z",
      "x_nadsec_last_seen": "2026-05-07T13:16:45.456Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T14:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--63ba1474-f56e-485c-a625-44bdd82d6931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T14:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:05:09.000Z",
      "valid_until": "2026-06-08T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T13:16:45.760Z",
      "x_nadsec_last_seen": "2026-05-07T13:16:45.760Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--f5eaa587-b392-4838-a933-d19cbbfc4224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.162.146.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:05:05.000Z",
      "valid_until": "2026-06-08T15:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T15:01:08.234Z",
      "x_nadsec_last_seen": "2026-05-07T15:03:12.482Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-07T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=53813; asn_org=ZSCALER, INC.",
      "id": "indicator--e6690933-fbed-49e6-b660-b50d43f5e750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.226.240.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:05:05.000Z",
      "valid_until": "2026-06-08T15:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T14:06:20.886Z",
      "x_nadsec_last_seen": "2026-05-07T14:06:21.053Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "53813"
      ],
      "x_nadsec_orgs": [
        "ZSCALER, INC."
      ]
    },
    {
      "created": "2026-05-07T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--ed7d6c1f-fff6-4190-abe6-2a822d684784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:05:05.000Z",
      "valid_until": "2026-06-08T15:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T14:23:07.551Z",
      "x_nadsec_last_seen": "2026-05-07T14:23:37.555Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-07T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7280e47c-cde8-4282-9d73-d1cc2b719f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.188.189.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:05:05.000Z",
      "valid_until": "2026-06-08T15:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T14:19:55.568Z",
      "x_nadsec_last_seen": "2026-05-07T14:20:05.762Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:05:05.000Z",
      "valid_until": "2026-06-08T15:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T14:06:31.224Z",
      "x_nadsec_last_seen": "2026-05-22T05:00:29.947Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-07T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LT; asn=8764; asn_org=Telia Lietuva, AB",
      "id": "indicator--fa49535a-6bbb-4a4d-a003-c832edfd8147",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.135.242.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T15:05:05.000Z",
      "valid_until": "2026-06-08T15:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T14:19:20.021Z",
      "x_nadsec_last_seen": "2026-05-07T14:21:27.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "8764"
      ],
      "x_nadsec_orgs": [
        "Telia Lietuva, AB"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--fabddb59-7f02-41f1-a88f-4bdd775deca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.88.109.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T15:16:39.542Z",
      "x_nadsec_last_seen": "2026-05-07T15:18:47.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--58b0c80b-6b93-4f6b-addf-f81c774e5d7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.57.225.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T15:39:21.443Z",
      "x_nadsec_last_seen": "2026-05-07T15:39:21.443Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=264088; asn_org=TOLEDO FIBRA TELECOMUNICACAO LTDA",
      "id": "indicator--2cc1843e-e3e9-4f05-8520-793b45330b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.208.7.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T15:36:32.835Z",
      "x_nadsec_last_seen": "2026-05-07T15:43:39.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264088"
      ],
      "x_nadsec_orgs": [
        "TOLEDO FIBRA TELECOMUNICACAO LTDA"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=BR; asn=263019; asn_org=QUICKNET TELECOM LTDA",
      "id": "indicator--8747e522-8ec1-46ad-8c84-c3ab4a3e15dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.10.171.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-07T15:16:47.667Z",
      "x_nadsec_last_seen": "2026-05-29T18:05:32.522Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263019"
      ],
      "x_nadsec_orgs": [
        "QUICKNET TELECOM LTDA"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28295; asn_org=Diagnosticos da America S.A.",
      "id": "indicator--c6bb1f16-f944-49d5-b6e2-a02fbe578f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.39.66.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T15:58:10.157Z",
      "x_nadsec_last_seen": "2026-05-07T16:00:16.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28295"
      ],
      "x_nadsec_orgs": [
        "Diagnosticos da America S.A."
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--051d1c64-f795-4671-a63b-75fe7de8374d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.209.30.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T16:01:17.045Z",
      "x_nadsec_last_seen": "2026-05-07T16:03:24.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=ftpd; ports=21; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-07T15:53:55.847Z",
      "x_nadsec_last_seen": "2026-05-07T15:54:00.320Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1433",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--efe76f37-1387-4e9b-8ec7-62ebdd0cac4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.217.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T15:26:48.337Z",
      "x_nadsec_last_seen": "2026-05-07T15:26:58.496Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b123ced4-a4a5-414d-8376-481ec094b8d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T15:20:55.558Z",
      "x_nadsec_last_seen": "2026-05-27T06:32:42.293Z",
      "x_nadsec_ports": [
        "3306",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--afa5e192-5ef8-47a4-92d9-85ff4e5e8188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.92.88.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T15:40:21.531Z",
      "x_nadsec_last_seen": "2026-05-07T15:40:21.531Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=IR; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--c44a325b-9501-4690-b350-3e498290f4ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T15:38:50.680Z",
      "x_nadsec_last_seen": "2026-05-07T15:39:06.688Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--8b1e72ba-9430-4828-b0ee-5c4a3ccb7171",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.36.141.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T15:59:25.855Z",
      "x_nadsec_last_seen": "2026-05-07T16:07:14.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-05-07T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--6198f645-4b34-4417-80c1-c8aecef5816e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.164.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:05:11.000Z",
      "valid_until": "2026-06-08T16:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T15:40:06.483Z",
      "x_nadsec_last_seen": "2026-05-07T15:45:17.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-07T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=132655; asn_org=Sekretariat Jenderal Dewan Perwakilan Daerah Republik Indonesia",
      "id": "indicator--1023278a-ef41-4fcd-852f-c105b6ad92f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.139.24.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:05:09.000Z",
      "valid_until": "2026-06-08T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T16:49:42.599Z",
      "x_nadsec_last_seen": "2026-05-07T16:51:46.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "132655"
      ],
      "x_nadsec_orgs": [
        "Sekretariat Jenderal Dewan Perwakilan Daerah Republik Indonesia"
      ]
    },
    {
      "created": "2026-05-07T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--75acf94d-2222-48ce-8fb9-0f5c879d2af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.115.200.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:05:09.000Z",
      "valid_until": "2026-06-08T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T16:56:51.303Z",
      "x_nadsec_last_seen": "2026-05-07T16:58:57.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-07T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--50ba8a45-005f-4320-b733-8c6adc32ab5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.117.115.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:05:09.000Z",
      "valid_until": "2026-06-08T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T16:33:47.258Z",
      "x_nadsec_last_seen": "2026-05-07T16:35:54.774Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-07T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3f65e120-8a56-4310-8b2b-afde534359a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.20.144.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:05:09.000Z",
      "valid_until": "2026-06-08T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T16:23:55.535Z",
      "x_nadsec_last_seen": "2026-05-07T16:26:01.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-07T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8a0366af-075f-46e3-8b11-c16b969d7072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:05:09.000Z",
      "valid_until": "2026-06-08T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T16:42:43.102Z",
      "x_nadsec_last_seen": "2026-05-07T16:42:43.102Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--d99608f3-27a8-42e5-8372-75cec2e5f000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.68.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T17:59:29.061Z",
      "x_nadsec_last_seen": "2026-05-07T18:01:36.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T17:05:16.840Z",
      "x_nadsec_last_seen": "2026-05-07T17:05:16.840Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f43d983c-95b0-4960-a5de-0623ef0edbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T17:23:37.834Z",
      "x_nadsec_last_seen": "2026-05-07T17:24:07.276Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--37ec54ca-cc59-4363-ae34-f94298c0fa33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T17:40:08.489Z",
      "x_nadsec_last_seen": "2026-05-07T17:40:33.961Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b92b8d07-6c7c-4fb1-af1e-d2a85472f0f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.16.18.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T17:30:34.458Z",
      "x_nadsec_last_seen": "2026-05-07T17:32:41.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--25a60497-5d49-40c5-8277-a68b452af4b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T17:08:59.816Z",
      "x_nadsec_last_seen": "2026-05-07T17:09:04.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d2895375-4d0e-4649-87ee-f11454d6932b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T17:13:52.203Z",
      "x_nadsec_last_seen": "2026-05-07T17:13:52.203Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9ed718cb-fb30-4669-a5d7-08f0a2273453",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T17:13:51.942Z",
      "x_nadsec_last_seen": "2026-05-07T17:13:51.942Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--d3c063e3-c79b-426b-b30d-60a00d75f600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T18:05:05.000Z",
      "valid_until": "2026-06-08T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T17:05:22.503Z",
      "x_nadsec_last_seen": "2026-05-07T17:05:22.503Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--73aa9c21-9399-4d8e-afb4-9b4ed1c67d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.119.16.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T18:24:09.012Z",
      "x_nadsec_last_seen": "2026-05-07T18:24:09.012Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--0e7eca59-6109-4da4-a077-197430a682e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.201.249.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T18:26:57.877Z",
      "x_nadsec_last_seen": "2026-05-07T18:29:04.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e955d923-219b-45ea-bd7b-49302da87d13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.97.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T18:54:23.743Z",
      "x_nadsec_last_seen": "2026-05-07T18:54:23.743Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e0cb8a6b-c1c2-468e-89d0-1adc44d2b610",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.59.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-07T18:13:07.389Z",
      "x_nadsec_last_seen": "2026-05-13T18:07:57.353Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--f69de0ca-7778-462e-8325-83f5749737f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T18:24:19.967Z",
      "x_nadsec_last_seen": "2026-05-07T18:24:20.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b39373ed-6ca4-4f14-b86c-ddbf47c81fd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.28.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T18:05:47.475Z",
      "x_nadsec_last_seen": "2026-05-07T18:06:11.207Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T18:35:05.464Z",
      "x_nadsec_last_seen": "2026-05-19T09:35:26.314Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--57884685-6ead-4bde-a54e-0dee4f43b86c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.249.128.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T18:05:57.225Z",
      "x_nadsec_last_seen": "2026-05-07T18:06:07.401Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--bf4a0516-e166-4234-a6ed-f97a0ea67b57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.222.135.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T18:22:42.094Z",
      "x_nadsec_last_seen": "2026-05-07T18:22:42.094Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-07T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--e54713d8-7078-4cc1-973b-8e94f651a360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.51.172.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T19:05:10.000Z",
      "valid_until": "2026-06-08T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T18:54:41.702Z",
      "x_nadsec_last_seen": "2026-05-07T18:54:46.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=138842; asn_org=PT Internetwork Komunikasi Indonesia",
      "id": "indicator--679c12bc-a122-43c4-8a61-852b50b59807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.155.106.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T19:26:01.646Z",
      "x_nadsec_last_seen": "2026-05-07T19:28:07.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138842"
      ],
      "x_nadsec_orgs": [
        "PT Internetwork Komunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7fcdd2d0-bdea-4e53-b90a-479dd85a6291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.190.17.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T19:59:29.308Z",
      "x_nadsec_last_seen": "2026-05-07T19:59:54.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3b439ae6-3cba-4bf5-baf9-58d9cf3ba43f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.163.142.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T19:30:57.865Z",
      "x_nadsec_last_seen": "2026-05-07T19:33:03.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--708d24ce-b8dd-4dcd-b2ea-4bdb59acc96b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.94.131.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T19:17:06.212Z",
      "x_nadsec_last_seen": "2026-05-31T11:23:42.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--070186f1-1bd0-437d-8010-85dafb1fab0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T19:28:30.078Z",
      "x_nadsec_last_seen": "2026-05-09T21:08:13.757Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--d5b1f15c-7eef-43e4-b006-bfde6eef621c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.248.28.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T19:35:32.776Z",
      "x_nadsec_last_seen": "2026-05-07T19:55:32.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--887e7f19-1b90-455a-8cf8-5891f4ec39b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.228.247.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-07T19:57:12.685Z",
      "x_nadsec_last_seen": "2026-05-07T21:45:46.003Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T19:26:40.582Z",
      "x_nadsec_last_seen": "2026-05-27T18:32:16.349Z",
      "x_nadsec_ports": [
        "1433",
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--159ab205-c168-4fec-9aa2-7e6eae7f81e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.59.14.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T19:51:58.180Z",
      "x_nadsec_last_seen": "2026-05-14T01:37:30.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3fd44e11-6bab-4835-a15e-ca53f7623448",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T19:27:41.558Z",
      "x_nadsec_last_seen": "2026-05-07T19:27:41.558Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--528d057f-7ec1-4bfb-bc36-77d5949ca368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T19:27:01.290Z",
      "x_nadsec_last_seen": "2026-05-07T19:27:01.290Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3c2b1815-ae35-4481-a156-44354210ea0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T19:27:00.691Z",
      "x_nadsec_last_seen": "2026-05-10T09:37:49.391Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4ea1e490-a64b-460a-b6a9-607563219a71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:05:11.000Z",
      "valid_until": "2026-06-08T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T19:27:31.218Z",
      "x_nadsec_last_seen": "2026-05-07T19:27:31.218Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-07T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--f4fa449e-2e99-4830-9d54-89e49b9dc462",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.121.234.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:05:09.000Z",
      "valid_until": "2026-06-08T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T20:33:18.823Z",
      "x_nadsec_last_seen": "2026-05-07T20:33:18.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-05-07T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e5125a2-fb77-45bd-b5c3-f14ee16322c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:05:09.000Z",
      "valid_until": "2026-06-08T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T20:26:01.470Z",
      "x_nadsec_last_seen": "2026-05-25T20:51:18.459Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:05:09.000Z",
      "valid_until": "2026-06-08T21:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T20:35:53.073Z",
      "x_nadsec_last_seen": "2026-05-07T20:35:54.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9e9f6fc5-d9e7-4c05-9f26-2fa4e562acb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:05:09.000Z",
      "valid_until": "2026-06-08T21:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-07T20:05:32.912Z",
      "x_nadsec_last_seen": "2026-05-27T10:16:40.252Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f8ccc893-d8c0-4d50-8d52-128a4d275695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.199.121.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:05:09.000Z",
      "valid_until": "2026-06-08T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T20:55:56.255Z",
      "x_nadsec_last_seen": "2026-05-07T20:55:59.415Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-07T21:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--7ab813af-ac62-4999-91dd-0be4c4685026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T21:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.58.147.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:05:09.000Z",
      "valid_until": "2026-06-08T21:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-07T20:36:42.876Z",
      "x_nadsec_last_seen": "2026-05-27T02:51:41.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-07T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--37ed7123-4f85-480b-8cd5-65f6257d5e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.228.58.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:05:11.000Z",
      "valid_until": "2026-06-08T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T21:41:25.501Z",
      "x_nadsec_last_seen": "2026-05-07T21:41:25.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-07T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1c904a88-fd0c-4664-93c3-883cc82bf73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:05:11.000Z",
      "valid_until": "2026-06-08T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T22:03:36.887Z",
      "x_nadsec_last_seen": "2026-05-07T22:03:47.046Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ccae48bd-7d6d-4856-9e02-bf959fe64566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.109.28.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:05:11.000Z",
      "valid_until": "2026-06-08T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T21:40:49.292Z",
      "x_nadsec_last_seen": "2026-05-07T21:40:49.527Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-07T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d027aac0-c30c-402b-92e1-b55bd22a4d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.232.129.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:05:11.000Z",
      "valid_until": "2026-06-08T22:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-07T21:17:34.490Z",
      "x_nadsec_last_seen": "2026-05-08T01:25:09.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-07T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--c597f52d-272e-4ff3-b1c4-68f26ac007b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.163.40.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:05:11.000Z",
      "valid_until": "2026-06-08T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T21:44:09.168Z",
      "x_nadsec_last_seen": "2026-05-07T21:49:16.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d4a93990-09ed-4773-b86a-c5d854057f01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.249.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T22:23:38.687Z",
      "x_nadsec_last_seen": "2026-05-07T22:23:58.305Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--69d18b56-f895-40c7-8cc4-fd99f5c660f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.201.19.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T23:01:44.779Z",
      "x_nadsec_last_seen": "2026-05-07T23:09:12.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet; user(top)=**",
      "id": "indicator--092eaacf-ea8a-40e3-91fa-3ea31833a6fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.43.179.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T22:09:15.568Z",
      "x_nadsec_last_seen": "2026-05-07T22:09:15.568Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UA; asn=28761; asn_org=CrimeaCom South LLC",
      "id": "indicator--3d4ba998-604e-4e4e-9b26-d3fb0b7bae0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.26.81.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T22:33:06.650Z",
      "x_nadsec_last_seen": "2026-05-07T22:33:06.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "28761"
      ],
      "x_nadsec_orgs": [
        "CrimeaCom South LLC"
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--4f48815d-3e67-406f-98d6-5ac48db3338e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-07T23:01:07.545Z",
      "x_nadsec_last_seen": "2026-05-25T21:21:30.338Z",
      "x_nadsec_ports": [
        "81",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e5fa206d-2c01-4618-b248-26319263c392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.202.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T22:35:59.452Z",
      "x_nadsec_last_seen": "2026-05-07T22:35:59.452Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6902a184-062a-4bd5-8709-a46ef9b4fa0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-07T22:11:05.470Z",
      "x_nadsec_last_seen": "2026-05-07T22:11:05.470Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=11232; asn_org=Midcontinent Communications",
      "id": "indicator--0e023db2-402a-4ee3-9387-e6fa63dfa56f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.124.41.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T22:40:27.109Z",
      "x_nadsec_last_seen": "2026-05-07T22:47:19.026Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11232"
      ],
      "x_nadsec_orgs": [
        "Midcontinent Communications"
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--6e896a03-1b33-4180-8bf8-42297b565d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.205.250.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T22:13:05.290Z",
      "x_nadsec_last_seen": "2026-05-07T22:15:10.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--5abda58d-b8a6-44f1-87c3-480d157957e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T22:31:09.578Z",
      "x_nadsec_last_seen": "2026-05-12T03:19:35.037Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-07T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--270e42e9-5546-4d64-b527-2f338b734d1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-07T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.0.235.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T23:05:10.000Z",
      "valid_until": "2026-06-08T23:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-07T22:12:34.165Z",
      "x_nadsec_last_seen": "2026-05-07T22:13:23.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--81546474-836e-4c4a-afd3-799f7b49b96b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.52.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-07T23:46:00.454Z",
      "x_nadsec_last_seen": "2026-05-07T23:48:49.462Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--66e3c1c3-b1aa-4f93-b440-b215ea23d7dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T00:03:50.206Z",
      "x_nadsec_last_seen": "2026-05-08T00:03:50.206Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=58314; asn_org=SvyazResurs-Kuban, LLC",
      "id": "indicator--ca37e72f-f931-4740-a2cc-764555119909",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.91.252.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-07T23:40:28.974Z",
      "x_nadsec_last_seen": "2026-05-07T23:48:23.668Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "58314"
      ],
      "x_nadsec_orgs": [
        "SvyazResurs-Kuban, LLC"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--6fb9bae3-baee-4496-b6f4-00678b6bf2d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.9.170.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-07T23:57:28.037Z",
      "x_nadsec_last_seen": "2026-05-07T23:59:35.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7ff1a1a3-7857-439c-ace8-08a280d610f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.211.110.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T23:48:52.708Z",
      "x_nadsec_last_seen": "2026-05-09T01:08:58.333Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2eb7534f-3361-440b-af44-48157a5021db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T23:59:51.995Z",
      "x_nadsec_last_seen": "2026-05-12T23:14:57.158Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--47ae71a6-bb97-460d-9340-9c7b67722793",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.53.158.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T23:30:26.474Z",
      "x_nadsec_last_seen": "2026-05-07T23:30:26.984Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-08T00:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--96349934-5da5-42a8-bb60-7d183f9dc247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T00:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T00:05:23.000Z",
      "valid_until": "2026-06-09T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-07T23:30:56.258Z",
      "x_nadsec_last_seen": "2026-05-12T16:32:59.278Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--f4e1e380-a605-4743-bf4b-4d833a460ea5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.250.147.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T00:40:19.383Z",
      "x_nadsec_last_seen": "2026-05-18T04:16:28.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--bc19a7bc-f122-4472-b77d-a94fe6921f51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.97.178.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T00:39:49.416Z",
      "x_nadsec_last_seen": "2026-05-08T00:39:49.416Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3c425c4f-485d-4525-8dbb-3251a6d48a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.238.44.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T00:16:37.823Z",
      "x_nadsec_last_seen": "2026-05-08T00:16:43.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269820; asn_org=FULL DATA COMUNICACIONES C.A.",
      "id": "indicator--92b4bb19-b945-4a65-9619-1eeb7d375656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.43.208.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-08T00:30:18.975Z",
      "x_nadsec_last_seen": "2026-05-21T08:20:39.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269820"
      ],
      "x_nadsec_orgs": [
        "FULL DATA COMUNICACIONES C.A."
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--5824576a-3d03-4431-8105-37c21240aa28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.90.205.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T00:52:19.017Z",
      "x_nadsec_last_seen": "2026-05-08T00:52:19.017Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=136190; asn_org=JINHUA, ZHEJIANG Province, P.R.China.",
      "id": "indicator--a2b177eb-918a-4f7e-b6a4-8b3e0dfc7340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.188.108.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T00:56:05.166Z",
      "x_nadsec_last_seen": "2026-05-08T00:58:13.397Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136190"
      ],
      "x_nadsec_orgs": [
        "JINHUA, ZHEJIANG Province, P.R.China."
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--63563ca8-48da-4d26-ac31-42185e8d58bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-08T00:11:18.064Z",
      "x_nadsec_last_seen": "2026-05-29T21:37:25.920Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9c37c9fe-39ab-4f1a-921f-1b0231d7db5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:05:10.000Z",
      "valid_until": "2026-06-09T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T00:25:35.091Z",
      "x_nadsec_last_seen": "2026-05-08T00:25:35.091Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--00704f3a-ed74-40d2-92d6-77dd4d97d8cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.14.95.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:05:10.000Z",
      "valid_until": "2026-06-09T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T01:40:41.743Z",
      "x_nadsec_last_seen": "2026-05-23T22:40:37.416Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--aced7148-afa3-48b0-942d-8b615684eaa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.30.200.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-08T02:53:11.406Z",
      "x_nadsec_last_seen": "2026-05-08T02:53:19.823Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2bc7bcbd-e395-4b8f-a3ac-400c64dd20ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.173.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T02:16:24.787Z",
      "x_nadsec_last_seen": "2026-05-08T02:18:29.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--d1c3cf45-04fd-49bc-9fc7-11ebdb17e8cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T02:58:15.794Z",
      "x_nadsec_last_seen": "2026-05-29T19:44:58.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--717f603a-e198-4453-b528-eceb869a4380",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.159.94.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T02:31:35.807Z",
      "x_nadsec_last_seen": "2026-05-08T02:39:27.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--956db0a6-f276-4f3d-84d4-1cfb276ced65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T02:43:25.545Z",
      "x_nadsec_last_seen": "2026-05-08T02:43:25.545Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--348399ed-7bb7-421e-b2fb-f2f513e46593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.168.231.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T02:22:57.458Z",
      "x_nadsec_last_seen": "2026-05-08T02:25:04.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--0eee4e89-72b8-4ba6-ac4e-2794cc3e4913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.93.76.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-08T02:49:49.442Z",
      "x_nadsec_last_seen": "2026-05-08T02:53:34.805Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--be348985-8f5f-4c37-b6b7-6acc0ac69be7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.26.44.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T02:25:09.592Z",
      "x_nadsec_last_seen": "2026-05-08T02:32:15.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a1645d24-8fba-44c5-bbab-92942db11f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.229.171.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T02:23:49.431Z",
      "x_nadsec_last_seen": "2026-05-08T02:23:49.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--65bfbfac-5c65-4d86-9734-8e08efaf3c4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.173.243.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-08T02:24:07.227Z",
      "x_nadsec_last_seen": "2026-05-08T02:24:18.819Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-08T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--6c4568a9-e1f0-4920-8f89-61889c3824a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.243.126.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:05:10.000Z",
      "valid_until": "2026-06-09T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T02:35:08.187Z",
      "x_nadsec_last_seen": "2026-05-25T00:59:20.103Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58495; asn_org=PT Parsaoran Global Datatrans",
      "id": "indicator--e4087f08-ead8-4634-8435-c48ff97e01fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.137.65.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-08T03:41:57.019Z",
      "x_nadsec_last_seen": "2026-05-23T21:22:49.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58495"
      ],
      "x_nadsec_orgs": [
        "PT Parsaoran Global Datatrans"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--b3d67efc-68cd-45f5-be85-f35b973f654f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.23.39.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T03:07:22.615Z",
      "x_nadsec_last_seen": "2026-05-08T03:07:29.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=17494; asn_org=Telecom Operator & Internet Service Provider as well; user(top)=**",
      "id": "indicator--a41bbea1-beb2-402d-9aff-a3a2b0a0c8fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.49.41.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T03:59:51.466Z",
      "x_nadsec_last_seen": "2026-05-15T05:38:07.887Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "17494"
      ],
      "x_nadsec_orgs": [
        "Telecom Operator & Internet Service Provider as well"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--21827904-c1e5-4244-be73-7eac00ada749",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.248.82.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T04:04:28.202Z",
      "x_nadsec_last_seen": "2026-05-08T04:06:32.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50241; asn_org=Unittel Ltd",
      "id": "indicator--140d8ae3-2b88-4b71-ac30-545f06c50d02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.115.199.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T03:54:40.192Z",
      "x_nadsec_last_seen": "2026-05-08T03:59:59.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50241"
      ],
      "x_nadsec_orgs": [
        "Unittel Ltd"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--8cbf4a59-3e99-425b-884b-cda79877ef94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.82.88.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T03:15:59.727Z",
      "x_nadsec_last_seen": "2026-05-08T03:16:04.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--92dfbf58-ae2c-46e7-93ef-5015cc82e8c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.83.48.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T03:14:35.688Z",
      "x_nadsec_last_seen": "2026-05-08T03:21:11.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--0533c882-45cf-4f37-ba30-5c1c298762c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-05-08T03:43:37.076Z",
      "x_nadsec_last_seen": "2026-05-16T04:19:27.895Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T03:32:13.472Z",
      "x_nadsec_last_seen": "2026-05-29T23:08:55.979Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--219ccc9b-c531-4d02-a110-f67966eefc38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T03:51:17.735Z",
      "x_nadsec_last_seen": "2026-05-08T03:51:17.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-08T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e62c6e2d-7223-48d6-a928-7c486024e9c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:05:05.000Z",
      "valid_until": "2026-06-09T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T03:51:17.187Z",
      "x_nadsec_last_seen": "2026-05-08T03:51:17.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--260c2ca0-0dfd-4761-be75-0b305b8c648b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T05:25:03.811Z",
      "x_nadsec_last_seen": "2026-05-08T05:25:03.811Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a348fbce-101c-47ca-87b3-eb410343c49c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.167.30.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T05:43:08.571Z",
      "x_nadsec_last_seen": "2026-05-08T05:45:12.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--783bc55b-bcca-43f8-8c70-6c3606760b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.210.68.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T06:00:48.118Z",
      "x_nadsec_last_seen": "2026-05-08T06:00:58.528Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=209059; asn_org=G COM Ltd.",
      "id": "indicator--8b03218b-4276-4712-ad4c-f69d1420af08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.124.197.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T05:19:43.858Z",
      "x_nadsec_last_seen": "2026-05-08T05:34:26.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209059"
      ],
      "x_nadsec_orgs": [
        "G COM Ltd."
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=263009; asn_org=FORTE TELECOM LTDA.",
      "id": "indicator--eab00c1a-e750-446e-9aef-8e8c940399e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.237.53.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T06:00:00.644Z",
      "x_nadsec_last_seen": "2026-05-08T06:07:06.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263009"
      ],
      "x_nadsec_orgs": [
        "FORTE TELECOM LTDA."
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3c59f11a-590e-4cc8-b6f3-77bc21b59f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.14.73.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T06:02:49.716Z",
      "x_nadsec_last_seen": "2026-05-08T06:02:49.716Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6d96b222-8c8e-42f7-8282-3a74281fc1b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.135.130.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T05:57:55.246Z",
      "x_nadsec_last_seen": "2026-05-08T05:58:05.243Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8c0de635-6e93-4b3a-8ef9-9b6e3d8493b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.70.175.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-08T05:35:04.686Z",
      "x_nadsec_last_seen": "2026-05-08T06:53:59.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--31fa763d-3c61-412b-841d-94b183d5f2e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.78.104.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T05:38:42.574Z",
      "x_nadsec_last_seen": "2026-05-08T05:45:12.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1277904d-69f6-4a5f-84f3-1955c5f8c304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.81.165.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T05:43:08.449Z",
      "x_nadsec_last_seen": "2026-05-08T05:43:08.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a84bbaa7-5eab-482c-93bf-3f29a04b5e51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:05:10.000Z",
      "valid_until": "2026-06-09T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T05:43:42.578Z",
      "x_nadsec_last_seen": "2026-05-08T05:43:42.578Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8f9aa383-30d4-4ab1-b807-f82bd658b5d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.96.46.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:05:10.000Z",
      "valid_until": "2026-06-09T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T06:25:28.763Z",
      "x_nadsec_last_seen": "2026-05-08T06:27:34.372Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-08T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--2747540d-f196-4193-bb9a-9aa69a12193a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.158.67.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:05:10.000Z",
      "valid_until": "2026-06-09T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T06:39:02.749Z",
      "x_nadsec_last_seen": "2026-05-08T06:41:08.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-08T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9a6a9cc1-c44f-47b8-ba48-023e6251cc34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.246.111.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:05:10.000Z",
      "valid_until": "2026-06-09T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T06:07:11.259Z",
      "x_nadsec_last_seen": "2026-05-08T06:09:16.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132770; asn_org=Gazon Communications India Limited",
      "id": "indicator--4ced30c9-a14f-486a-bc04-040b94a221ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.119.59.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:05:10.000Z",
      "valid_until": "2026-06-09T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T06:07:59.006Z",
      "x_nadsec_last_seen": "2026-05-08T06:10:03.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132770"
      ],
      "x_nadsec_orgs": [
        "Gazon Communications India Limited"
      ]
    },
    {
      "created": "2026-05-08T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--1a0dfa43-c42d-40b2-acf3-8a833e51a637",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.149.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:05:10.000Z",
      "valid_until": "2026-06-09T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T06:21:05.211Z",
      "x_nadsec_last_seen": "2026-05-08T06:21:05.211Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=569; services=smbd; ports=445; cc=IN; asn=139508; asn_org=Wide Netcom India",
      "id": "indicator--2ce4e4c5-56b6-4e4c-b569-47f21ba7c2de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.146.232.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 569,
      "x_nadsec_first_seen": "2026-05-08T07:44:51.516Z",
      "x_nadsec_last_seen": "2026-05-08T08:04:53.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139508"
      ],
      "x_nadsec_orgs": [
        "Wide Netcom India"
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--4f84af73-293a-4043-88f9-591b43192ec1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.236.42.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-08T07:45:52.351Z",
      "x_nadsec_last_seen": "2026-05-08T08:09:55.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--648ddfbe-e17e-4777-a05a-1374b737d81f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.63.249.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T07:48:00.253Z",
      "x_nadsec_last_seen": "2026-05-08T07:57:33.988Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--eadd0f2a-c1f4-4435-9239-0d537978a3bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T07:42:58.186Z",
      "x_nadsec_last_seen": "2026-05-08T07:42:58.186Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--74791781-df24-4f59-ad1d-e99147e134bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.75.164.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-08T07:31:34.352Z",
      "x_nadsec_last_seen": "2026-05-31T14:09:02.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--077323e7-5759-4285-8a63-ecd656757cce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T07:38:52.445Z",
      "x_nadsec_last_seen": "2026-05-08T07:38:52.445Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=epmapper; ports=135; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--8f6cb2eb-dcc9-4e11-8ad8-ceab7b9b8c59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-08T08:01:11.416Z",
      "x_nadsec_last_seen": "2026-05-29T15:17:11.558Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--457051d2-ca3d-41ec-a10f-355e43e4c494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.126.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T07:51:29.737Z",
      "x_nadsec_last_seen": "2026-05-08T07:51:53.431Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-08T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BH; asn=5416; asn_org=Beyon B.s.c.",
      "id": "indicator--f89e3ac8-722b-4c93-b904-6e259c7c311b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.201.8.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:05:10.000Z",
      "valid_until": "2026-06-09T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T07:42:01.368Z",
      "x_nadsec_last_seen": "2026-05-08T10:15:30.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BH"
      ],
      "x_nadsec_asns": [
        "5416"
      ],
      "x_nadsec_orgs": [
        "Beyon B.s.c."
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--50087337-eaa3-42d0-9bf6-9192647cd34b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.200.6.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-08T08:54:59.374Z",
      "x_nadsec_last_seen": "2026-05-08T10:54:04.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6c7e8ee3-5aab-42f8-92c9-ce1b8185aa91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.124.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T08:42:29.952Z",
      "x_nadsec_last_seen": "2026-05-08T08:42:33.551Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--52f3c77b-89d4-45ae-9f1e-a36d86ed38f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.203.251.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T08:53:47.375Z",
      "x_nadsec_last_seen": "2026-05-08T08:53:48.285Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--e14a6228-31f7-4322-a59c-c8a643372ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.76.176.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T08:59:12.780Z",
      "x_nadsec_last_seen": "2026-05-18T05:07:21.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d5f99602-426a-4500-9427-858aba516313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.195.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T08:13:18.154Z",
      "x_nadsec_last_seen": "2026-05-28T18:54:40.079Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--e562fe8d-b1e0-4f0a-92dc-6955a16d0440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.32.59.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T08:51:31.070Z",
      "x_nadsec_last_seen": "2026-05-08T08:53:38.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10834"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--120b24e9-f5c9-403f-afb1-fcee1cba38cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.81.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-05-08T08:13:01.789Z",
      "x_nadsec_last_seen": "2026-05-08T08:17:56.946Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "s****a",
        "s********v"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ab7fa4b5-a68d-4502-8f6a-2624f50d93b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.74.247.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T08:15:40.510Z",
      "x_nadsec_last_seen": "2026-05-08T08:17:45.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--9a992da8-0669-40c0-9ada-304d14552518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T08:21:59.362Z",
      "x_nadsec_last_seen": "2026-05-30T06:01:38.950Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-08T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud; user(top)=a*******s; pass(top)=a*******s",
      "id": "indicator--2c020061-1f57-4d82-a07b-ef1254398c54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.35.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:05:10.000Z",
      "valid_until": "2026-06-09T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T08:29:12.318Z",
      "x_nadsec_last_seen": "2026-05-08T08:29:12.318Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-05-08T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BD; asn=137967; asn_org=Digicon Telecommunication Ltd",
      "id": "indicator--9555aff0-a1f2-42d5-a54e-08b4367b0cbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.134.26.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:05:10.000Z",
      "valid_until": "2026-06-09T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T09:33:35.780Z",
      "x_nadsec_last_seen": "2026-05-27T07:44:39.785Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "137967"
      ],
      "x_nadsec_orgs": [
        "Digicon Telecommunication Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--02df31db-5567-4f37-a222-1261494e8621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.16.62.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:05:10.000Z",
      "valid_until": "2026-06-09T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T10:03:05.431Z",
      "x_nadsec_last_seen": "2026-05-08T10:09:36.026Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-08T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.118.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:05:10.000Z",
      "valid_until": "2026-06-09T10:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-08T09:06:56.731Z",
      "x_nadsec_last_seen": "2026-05-08T09:09:31.538Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=211778; asn_org=IntarmIT LLC",
      "id": "indicator--fbbcf38d-2716-4a22-915d-fc9371241a25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.241.111.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:05:10.000Z",
      "valid_until": "2026-06-09T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T10:02:02.085Z",
      "x_nadsec_last_seen": "2026-05-08T10:04:08.731Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "211778"
      ],
      "x_nadsec_orgs": [
        "IntarmIT LLC"
      ]
    },
    {
      "created": "2026-05-08T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2a1b6318-1d31-4355-8d12-1959b9c51f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.219.0.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:05:10.000Z",
      "valid_until": "2026-06-09T10:05:09.000Z",
      "x_nadsec_event_count": 48,
      "x_nadsec_first_seen": "2026-05-08T09:11:43.715Z",
      "x_nadsec_last_seen": "2026-05-31T23:25:27.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-08T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0eab7689-b380-4679-a991-4437870f644c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.40.53.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:05:10.000Z",
      "valid_until": "2026-06-09T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T09:35:56.091Z",
      "x_nadsec_last_seen": "2026-05-08T09:43:51.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-08T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--02a8fe59-3603-4bbd-b0c0-a78d6fe1d0b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.55.248.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:05:10.000Z",
      "valid_until": "2026-06-09T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T09:08:40.698Z",
      "x_nadsec_last_seen": "2026-05-08T09:10:47.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=IN; asn=55352; asn_org=Microscan Internet Limited",
      "id": "indicator--c3f7b6d1-c1a8-4b68-a59e-9419e9b1193d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.204.163.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-08T10:33:48.568Z",
      "x_nadsec_last_seen": "2026-05-08T11:01:49.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55352"
      ],
      "x_nadsec_orgs": [
        "Microscan Internet Limited"
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--51e9c7db-7b4b-45b0-bb82-6b09c5a8a6d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T10:20:16.080Z",
      "x_nadsec_last_seen": "2026-05-08T10:20:16.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7049; asn_org=Silica Networks Argentina S.A.",
      "id": "indicator--a175f207-4ce8-4ffe-99f0-b3c18cfb44fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.0.228.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T10:39:19.712Z",
      "x_nadsec_last_seen": "2026-05-08T10:39:26.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7049"
      ],
      "x_nadsec_orgs": [
        "Silica Networks Argentina S.A."
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--b043dc2d-7b96-4698-8841-bf7fc39af5ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.233.64.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T10:48:56.424Z",
      "x_nadsec_last_seen": "2026-05-08T10:55:39.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--7ea63083-fe67-4f80-9372-6a0f6fb74dcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.191.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T10:45:02.251Z",
      "x_nadsec_last_seen": "2026-05-18T23:41:25.001Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--9c7b833b-612d-4a6c-86bc-0392226b3c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.233.88.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T10:45:02.904Z",
      "x_nadsec_last_seen": "2026-05-08T10:45:02.904Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--c17d455c-e783-47a0-a9ea-916c897dcede",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.227.24.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T11:03:00.118Z",
      "x_nadsec_last_seen": "2026-05-08T11:05:07.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-05-08T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--7b47f93b-0719-4654-a984-a926d6437033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.106.239.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:05:11.000Z",
      "valid_until": "2026-06-09T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T10:47:38.136Z",
      "x_nadsec_last_seen": "2026-05-14T03:07:53.925Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--6ee978c9-b3da-4131-a807-a31bba0889da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.166.228.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:05:10.000Z",
      "valid_until": "2026-06-09T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T11:40:23.837Z",
      "x_nadsec_last_seen": "2026-05-08T11:40:23.837Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--f2492d10-f95b-4e71-8af7-4f057286732f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.122.230.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:05:10.000Z",
      "valid_until": "2026-06-09T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T11:31:11.301Z",
      "x_nadsec_last_seen": "2026-05-08T11:33:16.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-08T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--0b1c7f20-1490-467b-9090-da62c8b3cc1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.252.44.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:05:10.000Z",
      "valid_until": "2026-06-09T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T11:52:59.417Z",
      "x_nadsec_last_seen": "2026-05-08T11:58:18.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-05-08T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=MD; asn=201813; asn_org=Contrust Solutions S.R.L.",
      "id": "indicator--1bdd7694-8352-4a0a-8cd9-57ff37a2bfc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:05:10.000Z",
      "valid_until": "2026-06-09T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T11:44:49.963Z",
      "x_nadsec_last_seen": "2026-05-08T11:45:05.978Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "201813"
      ],
      "x_nadsec_orgs": [
        "Contrust Solutions S.R.L."
      ]
    },
    {
      "created": "2026-05-08T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a8d310de-ac61-42e8-9c44-07aa6b47bd48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:05:10.000Z",
      "valid_until": "2026-06-09T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T11:34:52.954Z",
      "x_nadsec_last_seen": "2026-05-08T11:34:52.954Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mqttd; ports=1883; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--32f304d5-368d-4f32-9b2a-721da46ecbc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.86.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-08T12:48:39.681Z",
      "x_nadsec_last_seen": "2026-05-08T12:48:56.710Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d0bbc1ca-e811-4960-aab5-328da4e32b16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.138.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T12:40:10.551Z",
      "x_nadsec_last_seen": "2026-05-08T12:40:10.551Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31213; asn_org=PJSC MegaFon",
      "id": "indicator--0dbfa8a5-e1af-4350-bdd3-c8501f05e550",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.170.87.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T12:48:38.181Z",
      "x_nadsec_last_seen": "2026-05-08T12:57:08.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31213"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--45f44d82-d487-4029-abc4-b58706e756a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.153.6.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-08T12:34:26.638Z",
      "x_nadsec_last_seen": "2026-05-08T12:37:42.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T12:05:34.290Z",
      "x_nadsec_last_seen": "2026-05-08T12:06:06.790Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--54d7c922-5a31-4553-b45b-dedd022b2951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.166.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T12:14:48.339Z",
      "x_nadsec_last_seen": "2026-05-26T12:06:09.105Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=38769; asn_org=PT. Bit Technology Nusantara",
      "id": "indicator--fcffa55b-f9fc-4d0e-af0c-2b1b703dbc09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.230.28.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T12:07:24.522Z",
      "x_nadsec_last_seen": "2026-05-08T12:07:51.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38769"
      ],
      "x_nadsec_orgs": [
        "PT. Bit Technology Nusantara"
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=CO; asn=269822; asn_org=COLOMBIA MAS TV S.A.S",
      "id": "indicator--cff5c1ae-3e41-4c55-8b9e-b98064ba1693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.65.232.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-08T12:06:50.211Z",
      "x_nadsec_last_seen": "2026-05-08T12:53:31.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "269822"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA MAS TV S.A.S"
      ]
    },
    {
      "created": "2026-05-08T13:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--c4ad5430-c997-4d8b-8172-8129928db964",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T13:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:05:26.000Z",
      "valid_until": "2026-06-09T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T12:09:17.144Z",
      "x_nadsec_last_seen": "2026-05-08T12:09:17.144Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=34047; asn_org=LLC Internet-Service",
      "id": "indicator--dbd4710a-d63c-4644-92a0-f5a476c7a72f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.19.113.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:05:11.000Z",
      "valid_until": "2026-06-09T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T13:23:43.687Z",
      "x_nadsec_last_seen": "2026-05-08T13:29:10.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34047"
      ],
      "x_nadsec_orgs": [
        "LLC Internet-Service"
      ]
    },
    {
      "created": "2026-05-08T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CH; asn=39351; asn_org=31173 Services AB",
      "id": "indicator--6436093f-d34c-4c7c-849d-d9f75663082c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.32.127.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:05:11.000Z",
      "valid_until": "2026-06-09T14:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-08T13:30:14.008Z",
      "x_nadsec_last_seen": "2026-05-08T14:08:50.589Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "39351"
      ],
      "x_nadsec_orgs": [
        "31173 Services AB"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "f*********r",
        "a*******g",
        "a***********b",
        "a**********r"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23750; asn_org=GERRYS INFORMATION TECHNOLOGY PVT LTD.",
      "id": "indicator--e8354c42-7f6e-4a89-9219-ddcaaeb477d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.69.46.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:05:11.000Z",
      "valid_until": "2026-06-09T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T13:19:40.627Z",
      "x_nadsec_last_seen": "2026-05-08T13:21:51.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23750"
      ],
      "x_nadsec_orgs": [
        "GERRYS INFORMATION TECHNOLOGY PVT LTD."
      ]
    },
    {
      "created": "2026-05-08T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=59577; asn_org=LinkCom Networks LLC",
      "id": "indicator--579a38f8-4c10-4aa6-af2b-5b2c95f0cc23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.201.233.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:05:11.000Z",
      "valid_until": "2026-06-09T14:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-08T14:01:18.247Z",
      "x_nadsec_last_seen": "2026-05-08T15:02:42.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "59577"
      ],
      "x_nadsec_orgs": [
        "LinkCom Networks LLC"
      ]
    },
    {
      "created": "2026-05-08T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--ecd39e37-abb6-4d68-8a69-15e8bae892ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.50.143.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:05:11.000Z",
      "valid_until": "2026-06-09T14:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T13:29:39.375Z",
      "x_nadsec_last_seen": "2026-05-18T01:00:12.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ZA; asn=328361; asn_org=AXNET",
      "id": "indicator--831e6df6-af06-4be7-96d0-dc35a97b38b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.131.21.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T14:26:57.527Z",
      "x_nadsec_last_seen": "2026-05-30T20:42:30.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "328361"
      ],
      "x_nadsec_orgs": [
        "AXNET"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--afe508a7-2941-4c21-9501-1ea6be104d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.182.223.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T14:57:04.841Z",
      "x_nadsec_last_seen": "2026-05-21T02:03:34.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--795f6593-6707-42bb-b25a-e28550491a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.248.227.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T15:02:22.881Z",
      "x_nadsec_last_seen": "2026-05-08T15:02:34.139Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2d6bc56f-87b9-40aa-8e01-05edb1fd8f14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.173.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-08T14:52:38.476Z",
      "x_nadsec_last_seen": "2026-05-08T14:52:58.712Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=266732; asn_org=FIBERTEL PERU S.A.",
      "id": "indicator--307765cd-e254-4b07-91ff-bf988a1fbecc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.132.178.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T14:14:40.223Z",
      "x_nadsec_last_seen": "2026-05-08T14:16:47.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "266732"
      ],
      "x_nadsec_orgs": [
        "FIBERTEL PERU S.A."
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=28745; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--d82b46b9-58df-4bac-b101-393ea305b123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.165.53.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-08T14:48:33.317Z",
      "x_nadsec_last_seen": "2026-05-30T01:22:03.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28745"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5b5135dd-b157-4256-8d85-f86845086cd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.21.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T15:02:35.497Z",
      "x_nadsec_last_seen": "2026-05-09T01:08:56.463Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T14:55:17.506Z",
      "x_nadsec_last_seen": "2026-05-30T14:27:48.119Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-08T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f036ad83-09a4-40ca-a8e3-3b8dffdfb876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.147.148.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:05:11.000Z",
      "valid_until": "2026-06-09T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T14:21:29.747Z",
      "x_nadsec_last_seen": "2026-05-08T14:23:37.420Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c25b12d8-f988-42b6-9a86-ea5ead6e3fc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.73.220.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T15:26:11.406Z",
      "x_nadsec_last_seen": "2026-05-08T15:26:11.441Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=PK; asn=138423; asn_org=CMPak Limited",
      "id": "indicator--cbe5aedd-a613-4d68-abbd-3f16baa0afb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.134.199.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 3153,
      "x_nadsec_first_seen": "2026-05-08T15:40:16.038Z",
      "x_nadsec_last_seen": "2026-05-08T17:54:51.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "138423"
      ],
      "x_nadsec_orgs": [
        "CMPak Limited"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4acfb911-9d05-43db-8afe-c46e5552fb26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T15:13:26.680Z",
      "x_nadsec_last_seen": "2026-05-08T15:13:27.083Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--250fa092-1759-4898-aafc-9e5923cb7501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.169.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T15:55:29.765Z",
      "x_nadsec_last_seen": "2026-05-08T15:55:34.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--366d130a-9062-47e9-82c4-e07033db1eed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.228.216.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-08T15:50:23.584Z",
      "x_nadsec_last_seen": "2026-05-08T16:24:12.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c5c219aa-bc60-4990-97fb-0aaef71690fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.186.163.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T15:39:23.512Z",
      "x_nadsec_last_seen": "2026-05-08T16:15:33.139Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--b7cb652f-9df2-4343-a015-dd39d27e9c9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.75.143.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T15:18:13.043Z",
      "x_nadsec_last_seen": "2026-05-08T15:20:19.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a42c74fe-4319-4b9e-9b77-07e0ae983445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T16:04:05.290Z",
      "x_nadsec_last_seen": "2026-05-08T16:04:05.290Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b97d6d8c-02eb-4032-bc2d-54adfc6e4abe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.111.148.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T15:20:04.597Z",
      "x_nadsec_last_seen": "2026-05-08T15:20:04.597Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--f3ad7088-c6ee-42ad-8e41-ad9acad7f0f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.111.148.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T15:17:57.723Z",
      "x_nadsec_last_seen": "2026-05-08T15:20:02.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-08T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=3302; asn_org=Retelit Digital Services S.p.A.",
      "id": "indicator--14f7bd7f-002d-4e1a-862e-526ebaa09b74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.246.14.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:05:10.000Z",
      "valid_until": "2026-06-09T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T15:10:29.023Z",
      "x_nadsec_last_seen": "2026-05-08T15:17:44.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3302"
      ],
      "x_nadsec_orgs": [
        "Retelit Digital Services S.p.A."
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--85334f1d-eab5-4f0f-821f-db6cc43beef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T16:41:02.777Z",
      "x_nadsec_last_seen": "2026-05-08T16:41:02.777Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--11f05cc4-6d9a-40f3-992e-9135513c0007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.211.93.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T16:39:16.148Z",
      "x_nadsec_last_seen": "2026-05-08T16:41:21.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--389e034f-34d7-417d-a484-cfb0bd51fa8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.87.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T16:42:47.963Z",
      "x_nadsec_last_seen": "2026-05-08T16:42:47.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--3d5fd64c-9b68-4889-8389-5e0527b62689",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.111.179.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 6994,
      "x_nadsec_first_seen": "2026-05-08T17:02:45.782Z",
      "x_nadsec_last_seen": "2026-05-09T10:58:11.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=39153; asn_org=Joint-stock Company teleport Telecom",
      "id": "indicator--8f4c484c-e649-4cda-b113-9a3dc8ca8998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.253.29.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T16:51:07.438Z",
      "x_nadsec_last_seen": "2026-05-08T16:53:15.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39153"
      ],
      "x_nadsec_orgs": [
        "Joint-stock Company teleport Telecom"
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8f2fd020-43b9-4482-a72a-2ac184317c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.10.108.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T16:31:28.814Z",
      "x_nadsec_last_seen": "2026-05-08T16:33:35.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5ea437c2-2406-4a9f-ad6d-a81d0d421475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T16:32:19.488Z",
      "x_nadsec_last_seen": "2026-05-08T16:32:19.488Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-08T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0896d7a9-ae51-4279-9ae1-934da0307893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:05:10.000Z",
      "valid_until": "2026-06-09T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T16:32:19.112Z",
      "x_nadsec_last_seen": "2026-05-08T16:32:19.112Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ZA; asn=328548; asn_org=TOUCHNET-TELECOMMUNICATIONS-AS",
      "id": "indicator--29c176ba-2e4f-443f-9520-9c020919f0df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.23.194.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 88,
      "x_nadsec_first_seen": "2026-05-08T17:16:17.745Z",
      "x_nadsec_last_seen": "2026-05-22T03:58:03.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "328548"
      ],
      "x_nadsec_orgs": [
        "TOUCHNET-TELECOMMUNICATIONS-AS"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c8eaebb6-f042-4c3c-811f-e6eaa5357b4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.96.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T17:12:45.015Z",
      "x_nadsec_last_seen": "2026-05-08T17:12:52.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=134286; asn_org=Net for Choice",
      "id": "indicator--e437bed7-8d1b-409f-b3c9-4c2246b04e1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.109.7.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T17:59:26.518Z",
      "x_nadsec_last_seen": "2026-05-08T17:59:26.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134286"
      ],
      "x_nadsec_orgs": [
        "Net for Choice"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--21a0ab9e-0d3b-4d75-af61-eeca72fabf4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.117.101.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-08T17:44:03.079Z",
      "x_nadsec_last_seen": "2026-05-08T17:46:11.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3149; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c247b911-9856-4ed9-9c4a-7675861a2a76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.238.82.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-05-08T17:29:59.420Z",
      "x_nadsec_last_seen": "2026-05-08T17:59:23.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PE; asn=272801; asn_org=RED AMONES S.A.C.",
      "id": "indicator--7ffb8877-2da0-4d8c-8acc-b476a34d6d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.63.5.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T17:34:37.888Z",
      "x_nadsec_last_seen": "2026-05-08T17:41:28.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "272801"
      ],
      "x_nadsec_orgs": [
        "RED AMONES S.A.C."
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--0e96650b-2401-4213-8150-c7a865d63401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.226.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T17:45:41.145Z",
      "x_nadsec_last_seen": "2026-05-08T17:47:49.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=7604; asn_org=Zettagrid Pty Ltd",
      "id": "indicator--71df28b9-7198-4873-9323-82b5423ec959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.74.160.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T17:49:30.649Z",
      "x_nadsec_last_seen": "2026-05-08T17:49:31.447Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "7604"
      ],
      "x_nadsec_orgs": [
        "Zettagrid Pty Ltd"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=RO; asn=214295; asn_org=Skynet Network Ltd",
      "id": "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 33,
      "x_nadsec_first_seen": "2026-05-08T17:24:10.549Z",
      "x_nadsec_last_seen": "2026-05-12T07:05:42.546Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "214295"
      ],
      "x_nadsec_orgs": [
        "Skynet Network Ltd"
      ]
    },
    {
      "created": "2026-05-08T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--49696639-276e-44dd-ba45-b24616a9d591",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:05:10.000Z",
      "valid_until": "2026-06-09T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T17:28:38.914Z",
      "x_nadsec_last_seen": "2026-05-08T17:28:38.914Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=38712; asn_org=Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne",
      "id": "indicator--8ca51219-28e3-4462-9148-f412342669f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.50.8.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T18:11:11.207Z",
      "x_nadsec_last_seen": "2026-05-08T18:13:16.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38712"
      ],
      "x_nadsec_orgs": [
        "Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne"
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=25540; asn_org=Alphalink SASU",
      "id": "indicator--3bfd7de0-1d83-4d63-b02e-1d33ad651649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.93.20.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T18:17:56.327Z",
      "x_nadsec_last_seen": "2026-05-08T18:20:03.355Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "25540"
      ],
      "x_nadsec_orgs": [
        "Alphalink SASU"
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8a06f8d5-970c-4357-986f-549c4cd5242b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.235.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T19:02:12.799Z",
      "x_nadsec_last_seen": "2026-05-08T19:02:12.799Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ba4d4eb8-ddb1-4297-b141-1b18c886e0f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T18:32:16.376Z",
      "x_nadsec_last_seen": "2026-05-08T22:19:41.982Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T18:13:08.560Z",
      "x_nadsec_last_seen": "2026-05-30T09:50:07.242Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8e4c1f4b-1396-4faf-b540-4eb45fe302c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T18:37:26.182Z",
      "x_nadsec_last_seen": "2026-05-08T18:37:26.182Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--bc5f504c-464b-459a-871c-cbc6b7e1a2bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.159.229.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-05-08T18:53:05.456Z",
      "x_nadsec_last_seen": "2026-05-23T03:39:16.516Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-08T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--85d8e66d-fae4-4133-9f15-df67668cce39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:05:10.000Z",
      "valid_until": "2026-06-09T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T18:36:39.893Z",
      "x_nadsec_last_seen": "2026-05-20T00:35:00.614Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.145.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T19:29:18.613Z",
      "x_nadsec_last_seen": "2026-05-26T00:22:01.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--f0d1a70e-b01d-469b-b532-2e0a9ae5081d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.221.149.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T19:44:09.103Z",
      "x_nadsec_last_seen": "2026-05-15T17:38:05.119Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b20a0f06-febe-4f02-837a-605c72b3189b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.185.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T19:33:54.526Z",
      "x_nadsec_last_seen": "2026-05-08T19:34:04.696Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T19:39:42.238Z",
      "x_nadsec_last_seen": "2026-05-08T19:39:42.238Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T19:57:30.190Z",
      "x_nadsec_last_seen": "2026-05-25T01:29:09.617Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T19:34:36.029Z",
      "x_nadsec_last_seen": "2026-05-08T19:34:36.029Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8f5e312c-01e8-4432-84fe-433584f5c1be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T19:43:57.214Z",
      "x_nadsec_last_seen": "2026-05-19T14:22:09.112Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T20:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7f3e8252-9788-4b7f-ae39-27680ce0b349",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T20:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:05:09.000Z",
      "valid_until": "2026-06-09T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T19:45:04.872Z",
      "x_nadsec_last_seen": "2026-05-22T13:31:14.875Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "1723"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--58dde9cd-fc0d-417a-96aa-c7d716ecea70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.141.104.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T20:56:14.927Z",
      "x_nadsec_last_seen": "2026-05-08T20:58:19.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a0cd1a2a-201c-465d-93f9-6d72218ca699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.136.83.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T20:07:52.033Z",
      "x_nadsec_last_seen": "2026-05-08T20:09:56.893Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=264025; asn_org=Arroba Banda Larga",
      "id": "indicator--519ae41d-70e7-4d29-bb4f-4754153a9ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.137.32.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T20:33:01.966Z",
      "x_nadsec_last_seen": "2026-05-08T20:35:08.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264025"
      ],
      "x_nadsec_orgs": [
        "Arroba Banda Larga"
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=271129; asn_org=Rt Comunicacoes LTDA",
      "id": "indicator--8812df52-8d69-4973-ad40-f988b7833ad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.42.56.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-08T20:10:50.674Z",
      "x_nadsec_last_seen": "2026-05-25T18:32:02.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271129"
      ],
      "x_nadsec_orgs": [
        "Rt Comunicacoes LTDA"
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b4c4f89d-a7f1-46f9-a269-ad28868f981c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.251.32.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T20:56:15.176Z",
      "x_nadsec_last_seen": "2026-05-08T20:58:20.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=20485; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--c9b1cd4a-36e9-4baa-824a-d85d5c548569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.43.17.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T20:10:11.090Z",
      "x_nadsec_last_seen": "2026-05-08T20:11:22.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "20485"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=27901; asn_org=Pacifico Cable SPA.",
      "id": "indicator--aacdff97-bd53-4bd8-96a3-ff2d8f272549",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.110.160.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T20:21:45.085Z",
      "x_nadsec_last_seen": "2026-05-08T20:23:52.119Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27901"
      ],
      "x_nadsec_orgs": [
        "Pacifico Cable SPA."
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--bdd126a6-2d7e-4ad2-8f84-b0e86e01b8d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T20:59:11.197Z",
      "x_nadsec_last_seen": "2026-05-08T21:02:01.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=AE; asn=210718; asn_org=Five Cyber Host Security S.r.l.",
      "id": "indicator--4df96763-9d8a-4c62-ad28-d9aa12669574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.57.129.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T21:02:38.007Z",
      "x_nadsec_last_seen": "2026-05-08T23:02:09.296Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "210718"
      ],
      "x_nadsec_orgs": [
        "Five Cyber Host Security S.r.l."
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b7352c1e-a161-49a7-89da-f64640b3fc76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.77.216.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T20:56:55.989Z",
      "x_nadsec_last_seen": "2026-05-08T20:56:55.989Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=GE; asn=35805; asn_org=JSC Silknet; user(top)=**",
      "id": "indicator--3805cfb7-38b3-4386-b65d-d94d2fb6d227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.43.11.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T20:13:07.043Z",
      "x_nadsec_last_seen": "2026-05-23T10:26:13.972Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--208a7399-f71d-43bb-bf8c-1075a9ab9bf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.58.115.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:05:10.000Z",
      "valid_until": "2026-06-09T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T21:01:40.780Z",
      "x_nadsec_last_seen": "2026-05-08T21:06:37.144Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-08T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--eb7e2200-4d65-4e21-a640-ad5645e82e46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.49.30.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:05:10.000Z",
      "valid_until": "2026-06-09T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T21:58:13.787Z",
      "x_nadsec_last_seen": "2026-05-08T21:58:38.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-05-08T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=263589; asn_org=MGP TELECOM",
      "id": "indicator--ad9f26cc-22e3-478c-b189-9c21313f3045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.84.0.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:05:10.000Z",
      "valid_until": "2026-06-09T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T21:33:05.033Z",
      "x_nadsec_last_seen": "2026-05-08T21:40:08.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263589"
      ],
      "x_nadsec_orgs": [
        "MGP TELECOM"
      ]
    },
    {
      "created": "2026-05-08T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--5b796c42-2cca-4a50-b6cd-7bf352fbe9c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.111.207.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:05:10.000Z",
      "valid_until": "2026-06-09T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-08T22:00:58.196Z",
      "x_nadsec_last_seen": "2026-05-08T22:01:58.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-08T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf31c6fe-6f60-4de4-b970-2bd65e0cb906",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.76.117.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:05:10.000Z",
      "valid_until": "2026-06-09T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T21:06:45.621Z",
      "x_nadsec_last_seen": "2026-05-08T21:06:55.819Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-08T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--06b7348b-da36-4de2-851e-194377c78329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:05:10.000Z",
      "valid_until": "2026-06-09T22:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-08T21:56:22.601Z",
      "x_nadsec_last_seen": "2026-05-25T13:53:42.734Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "27017",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "smbd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-05-08T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--b0835c56-efa1-474a-b106-583d1e078fb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.239.79.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:05:10.000Z",
      "valid_until": "2026-06-09T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T21:54:33.725Z",
      "x_nadsec_last_seen": "2026-05-08T21:56:41.136Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-08T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=206092; asn_org=F.n.s. Holdings Limited",
      "id": "indicator--e1d4aabb-4447-4587-bce8-8bb8df75ddec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.144.19.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:05:11.000Z",
      "valid_until": "2026-06-09T23:05:09.000Z",
      "x_nadsec_event_count": 40,
      "x_nadsec_first_seen": "2026-05-08T22:08:51.654Z",
      "x_nadsec_last_seen": "2026-05-10T03:36:50.379Z",
      "x_nadsec_ports": [
        "3306",
        "81"
      ],
      "x_nadsec_services": [
        "mysqld",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "206092"
      ],
      "x_nadsec_orgs": [
        "F.n.s. Holdings Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n",
        "r**t",
        "a**********r",
        "c**n",
        "d****r"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-08T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=7029; asn_org=Windstream Communications LLC",
      "id": "indicator--752dcb4a-d076-4753-a3bd-5c6447a8c056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.102.68.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:05:11.000Z",
      "valid_until": "2026-06-09T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T22:49:30.900Z",
      "x_nadsec_last_seen": "2026-05-08T22:53:45.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7029"
      ],
      "x_nadsec_orgs": [
        "Windstream Communications LLC"
      ]
    },
    {
      "created": "2026-05-08T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=394684; asn_org=GOLD DATA USA INC",
      "id": "indicator--517df3ae-97a7-43ef-a89c-1ffb9d2ac160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.52.110.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:05:11.000Z",
      "valid_until": "2026-06-09T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T22:12:34.915Z",
      "x_nadsec_last_seen": "2026-05-08T22:16:43.403Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "394684"
      ],
      "x_nadsec_orgs": [
        "GOLD DATA USA INC"
      ]
    },
    {
      "created": "2026-05-08T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--178aa0ac-7c49-4033-97fa-ebc5113bc407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:05:11.000Z",
      "valid_until": "2026-06-09T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T22:18:12.830Z",
      "x_nadsec_last_seen": "2026-05-08T22:18:12.830Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-08T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4e861962-a64a-4c4c-b285-0ecc9b9a0e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:05:11.000Z",
      "valid_until": "2026-06-09T23:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-08T22:44:55.870Z",
      "x_nadsec_last_seen": "2026-05-16T19:33:58.350Z",
      "x_nadsec_ports": [
        "81",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-08T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=41435; asn_org=UnderNet LLC",
      "id": "indicator--2324b3c5-fc8f-40ee-b60b-6ea897d3a4cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.110.132.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:05:11.000Z",
      "valid_until": "2026-06-09T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-08T22:38:37.192Z",
      "x_nadsec_last_seen": "2026-05-08T22:45:22.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "41435"
      ],
      "x_nadsec_orgs": [
        "UnderNet LLC"
      ]
    },
    {
      "created": "2026-05-08T23:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7691a72b-f209-4b76-bdd6-a6caec8f6404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-08T23:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.9.138.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:05:11.000Z",
      "valid_until": "2026-06-09T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-08T22:44:59.240Z",
      "x_nadsec_last_seen": "2026-05-08T22:47:05.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-09T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3a1a6601-e68c-4f19-9611-d73319ddd678",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:05:10.000Z",
      "valid_until": "2026-06-10T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T23:54:38.261Z",
      "x_nadsec_last_seen": "2026-05-08T23:54:48.255Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--6686bd56-1670-4571-92e4-e82f5bc00731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.108.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:05:10.000Z",
      "valid_until": "2026-06-10T00:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-08T23:40:43.959Z",
      "x_nadsec_last_seen": "2026-05-22T05:26:23.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-09T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a5a8a12e-6a83-48b4-b17a-3bb28e99882a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:05:10.000Z",
      "valid_until": "2026-06-10T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-08T23:19:34.750Z",
      "x_nadsec_last_seen": "2026-05-08T23:19:34.750Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:05:10.000Z",
      "valid_until": "2026-06-10T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T23:43:43.010Z",
      "x_nadsec_last_seen": "2026-05-28T15:46:02.432Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--192477f9-56e9-4e8b-a2c1-f79a4cec0730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:05:10.000Z",
      "valid_until": "2026-06-10T00:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-08T23:42:55.515Z",
      "x_nadsec_last_seen": "2026-05-31T09:30:52.976Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-09T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12714; asn_org=PJSC MegaFon",
      "id": "indicator--a4756777-27e1-4f37-af51-8470c3aeffb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.90.41.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:05:10.000Z",
      "valid_until": "2026-06-10T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-08T23:42:38.248Z",
      "x_nadsec_last_seen": "2026-05-08T23:42:38.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12714"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--4c5c7fab-5894-4467-9a9f-ad0c3c094e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.19.78.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T00:11:58.805Z",
      "x_nadsec_last_seen": "2026-05-09T00:12:06.000Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--ec6582f9-2d51-49cc-8f55-0a43408098bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.209.92.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-09T00:31:21.786Z",
      "x_nadsec_last_seen": "2026-05-09T00:34:11.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f721b622-2ef5-4c0f-b9a3-239f7cfb2f97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.55.36.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T00:20:49.274Z",
      "x_nadsec_last_seen": "2026-05-09T00:28:03.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--609797dd-219f-4ec9-9296-d6efadeb33b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T00:34:07.552Z",
      "x_nadsec_last_seen": "2026-05-31T05:52:52.727Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--3ee68dba-3f34-4c02-a830-e942c0779118",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.4.123.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T00:39:50.049Z",
      "x_nadsec_last_seen": "2026-05-11T12:51:09.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--2220da4d-9528-43df-ae9a-11a675e59f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.219.170.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T00:34:42.209Z",
      "x_nadsec_last_seen": "2026-05-09T00:36:46.852Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d78b36ef-0375-4f30-94c0-d6b82d59e4c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T00:34:39.435Z",
      "x_nadsec_last_seen": "2026-05-09T00:34:39.435Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--edc05f00-7ea1-4146-955c-1d93f65eb68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T00:32:09.076Z",
      "x_nadsec_last_seen": "2026-05-09T00:32:09.076Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=15468; asn_org=KLGELECS-AS PJSC Rostelecom. Kaluga branch",
      "id": "indicator--cdeb1449-bd38-479f-b813-bf264641be84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.242.160.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:05:10.000Z",
      "valid_until": "2026-06-10T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T00:14:40.097Z",
      "x_nadsec_last_seen": "2026-05-09T00:16:46.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "15468"
      ],
      "x_nadsec_orgs": [
        "KLGELECS-AS PJSC Rostelecom. Kaluga branch"
      ]
    },
    {
      "created": "2026-05-09T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--c235c3cf-2cb8-431f-87cd-787f436058cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.218.108.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:05:10.000Z",
      "valid_until": "2026-06-10T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T01:21:26.164Z",
      "x_nadsec_last_seen": "2026-05-09T01:24:47.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-05-09T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6880f52c-b8fb-4522-bd58-187c4339867c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.248.54.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:05:10.000Z",
      "valid_until": "2026-06-10T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T01:08:54.596Z",
      "x_nadsec_last_seen": "2026-05-09T01:08:54.596Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-09T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=ZA; asn=327901; asn_org=Level7-AS",
      "id": "indicator--ec183068-f207-493b-8f11-fd9608f1c7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.220.15.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:05:10.000Z",
      "valid_until": "2026-06-10T02:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-05-09T01:27:18.126Z",
      "x_nadsec_last_seen": "2026-05-09T01:30:24.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327901"
      ],
      "x_nadsec_orgs": [
        "Level7-AS"
      ]
    },
    {
      "created": "2026-05-09T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--4461340d-f036-4389-a067-494220c9b66d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.221.116.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:05:10.000Z",
      "valid_until": "2026-06-10T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T01:09:48.164Z",
      "x_nadsec_last_seen": "2026-05-09T01:09:48.164Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-09T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.221.136.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:05:10.000Z",
      "valid_until": "2026-06-10T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T01:51:36.449Z",
      "x_nadsec_last_seen": "2026-05-09T01:51:36.449Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-09T03:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network",
      "id": "indicator--53842547-9ea3-4b97-b6d4-e585ec83223e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.243.134.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:05:09.000Z",
      "valid_until": "2026-06-10T03:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-09T02:08:33.265Z",
      "x_nadsec_last_seen": "2026-05-09T02:08:41.737Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4808"
      ],
      "x_nadsec_orgs": [
        "China Unicom Beijing Province Network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-05-09T03:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--00a7c61d-26a1-4417-8356-04ce7fea6b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:05:09.000Z",
      "valid_until": "2026-06-10T03:05:08.000Z",
      "x_nadsec_event_count": 138,
      "x_nadsec_first_seen": "2026-05-09T02:49:46.699Z",
      "x_nadsec_last_seen": "2026-05-09T03:29:29.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-05-09T03:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--8a60c344-cb81-4b7b-89e5-e12cf285c233",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.101.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:05:09.000Z",
      "valid_until": "2026-06-10T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T02:44:44.055Z",
      "x_nadsec_last_seen": "2026-05-09T02:45:07.742Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-09T03:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8e686bc1-85c9-4f8c-90f4-81d8173dba33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.127.87.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:05:09.000Z",
      "valid_until": "2026-06-10T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T02:33:25.553Z",
      "x_nadsec_last_seen": "2026-05-09T02:40:01.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-09T03:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=198195; asn_org=Martyukhin Pavel Alexandrovitch",
      "id": "indicator--d4161cba-12f6-4923-b255-d2aa78815d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T03:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.232.39.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:05:09.000Z",
      "valid_until": "2026-06-10T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T02:40:05.162Z",
      "x_nadsec_last_seen": "2026-05-09T02:41:15.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "198195"
      ],
      "x_nadsec_orgs": [
        "Martyukhin Pavel Alexandrovitch"
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=134365; asn_org=Ansheng Network Technology Co., Limited; user(top)=**",
      "id": "indicator--b9c89d34-051d-4b3a-8986-5a260e793b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.194.251.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T03:37:51.030Z",
      "x_nadsec_last_seen": "2026-05-09T03:37:51.030Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "134365"
      ],
      "x_nadsec_orgs": [
        "Ansheng Network Technology Co., Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--668f4567-549e-4d9f-84b4-1945da63ab31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.71.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-09T03:31:25.397Z",
      "x_nadsec_last_seen": "2026-05-09T03:34:54.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--de781a0e-6974-4061-a26d-0739e4c3ca07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.37.69.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-06T13:04:53.918Z",
      "x_nadsec_last_seen": "2026-05-09T03:35:00.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--fa2d206e-ea48-48da-aaee-9ffb6e2cd6b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.195.116.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T03:13:42.138Z",
      "x_nadsec_last_seen": "2026-05-09T03:15:47.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--90e9b4d8-94b5-4fe4-a2ab-614b2b7a2f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.180.159.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T03:20:39.564Z",
      "x_nadsec_last_seen": "2026-05-09T03:20:49.736Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T03:07:38.076Z",
      "x_nadsec_last_seen": "2026-05-18T15:10:19.444Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--609281d0-12b3-46df-a80a-1d40a8680dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T03:26:26.760Z",
      "x_nadsec_last_seen": "2026-05-09T03:26:26.760Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--653a046c-050d-4855-b05c-5e7f8fdb5282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.40.50.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T03:59:51.737Z",
      "x_nadsec_last_seen": "2026-05-09T04:07:55.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-09T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=47887; asn_org=Al-hadatheh Lil-itisalat Wa Al-technologia Co.",
      "id": "indicator--e288c731-08e2-4574-bf46-7c93442a2911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.212.125.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:05:10.000Z",
      "valid_until": "2026-06-10T04:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-09T03:31:31.393Z",
      "x_nadsec_last_seen": "2026-05-11T13:46:51.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "47887"
      ],
      "x_nadsec_orgs": [
        "Al-hadatheh Lil-itisalat Wa Al-technologia Co."
      ]
    },
    {
      "created": "2026-05-09T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=53062; asn_org=ALT | GRUPO BRASIL TECPAR",
      "id": "indicator--419bbc9b-d6cf-4594-88e2-cfbb1f710c90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.36.187.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:05:05.000Z",
      "valid_until": "2026-06-10T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T04:14:13.569Z",
      "x_nadsec_last_seen": "2026-05-09T04:14:13.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53062"
      ],
      "x_nadsec_orgs": [
        "ALT | GRUPO BRASIL TECPAR"
      ]
    },
    {
      "created": "2026-05-09T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--64fd27c1-ca58-4115-bd40-d6d076fc7af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:05:05.000Z",
      "valid_until": "2026-06-10T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T04:52:41.627Z",
      "x_nadsec_last_seen": "2026-05-09T04:52:41.952Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=20978; asn_org=TT Mobil Iletisim Hizmetleri A.S",
      "id": "indicator--eb7a0a44-7a78-4f2e-bf0e-7423cc7c8024",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.176.24.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:05:05.000Z",
      "valid_until": "2026-06-10T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T04:12:39.160Z",
      "x_nadsec_last_seen": "2026-05-09T04:14:46.052Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "20978"
      ],
      "x_nadsec_orgs": [
        "TT Mobil Iletisim Hizmetleri A.S"
      ]
    },
    {
      "created": "2026-05-09T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=TH; asn=133481; asn_org=AIS Fibre; user(top)=**",
      "id": "indicator--482e0e0c-2680-4b8b-acb1-660caab39769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.136.224.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:05:05.000Z",
      "valid_until": "2026-06-10T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T04:48:51.165Z",
      "x_nadsec_last_seen": "2026-05-09T04:48:51.695Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--53f4f1dc-664c-4e87-958b-7ce75aaaa51b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.243.113.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:05:05.000Z",
      "valid_until": "2026-06-10T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T04:22:43.301Z",
      "x_nadsec_last_seen": "2026-05-09T04:24:47.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-05-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--abf68990-e42c-4f23-83a4-b8c8e8504797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:05:10.000Z",
      "valid_until": "2026-06-10T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T05:50:59.601Z",
      "x_nadsec_last_seen": "2026-05-09T05:50:59.601Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--baea6f51-f88f-419f-a305-fbe1bfde1330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.196.23.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:05:10.000Z",
      "valid_until": "2026-06-10T06:05:09.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-05-09T05:48:03.304Z",
      "x_nadsec_last_seen": "2026-05-23T01:43:56.333Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--53f9a07b-dba2-4595-963a-22c1b8db0e24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:05:10.000Z",
      "valid_until": "2026-06-10T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T05:26:30.295Z",
      "x_nadsec_last_seen": "2026-05-09T05:26:30.295Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--f0f0b8cd-1a2a-426e-ba61-78442d5370b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.53.233.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:05:10.000Z",
      "valid_until": "2026-06-10T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T05:15:15.602Z",
      "x_nadsec_last_seen": "2026-05-09T05:15:15.602Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--573e4185-79ac-4afa-9b37-a85f13825d70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.78.14.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:05:10.000Z",
      "valid_until": "2026-06-10T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T05:15:19.246Z",
      "x_nadsec_last_seen": "2026-05-09T05:15:57.314Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=135700; asn_org=N R DATA SERVICE PVT LTD",
      "id": "indicator--0d185215-3ea0-49bd-9327-bd10ac59ce9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.173.147.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 120,
      "x_nadsec_first_seen": "2026-05-09T06:40:42.424Z",
      "x_nadsec_last_seen": "2026-05-09T08:45:03.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135700"
      ],
      "x_nadsec_orgs": [
        "N R DATA SERVICE PVT LTD"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--513f9437-af24-44a7-a944-a41905ef9bff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.162.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T06:51:45.539Z",
      "x_nadsec_last_seen": "2026-05-09T06:58:10.339Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--65eeb4e6-fdc0-4175-a9a5-6f9decc4e983",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.250.155.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T07:00:50.318Z",
      "x_nadsec_last_seen": "2026-05-09T07:05:07.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1badad10-6d46-43b9-8cc9-c6054907ff25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T06:42:10.677Z",
      "x_nadsec_last_seen": "2026-05-09T06:42:11.088Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6acc45b0-e13a-4f57-87f0-975d5fba3f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.1.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-09T06:08:38.589Z",
      "x_nadsec_last_seen": "2026-05-28T04:16:19.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IL; asn=202940; asn_org=ITC NG ltd",
      "id": "indicator--b8680ecc-154e-45b0-87bc-24fdd8f97787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.236.186.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T06:27:28.743Z",
      "x_nadsec_last_seen": "2026-05-20T06:54:07.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "202940"
      ],
      "x_nadsec_orgs": [
        "ITC NG ltd"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--acf504b0-fcf0-48e1-ab66-c3b7a4913818",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T06:06:49.654Z",
      "x_nadsec_last_seen": "2026-05-09T06:06:49.654Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--37a22b7f-8cae-46b5-a8ba-bcd28f9790d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.47.56.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T06:30:55.756Z",
      "x_nadsec_last_seen": "2026-05-09T06:31:41.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--aec82b0e-19cb-4743-a9a4-0e791d9eed6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.179.174.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-09T06:21:42.567Z",
      "x_nadsec_last_seen": "2026-05-11T19:12:34.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--3403d14d-9599-4bcc-be63-a26dd910b102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.248.9.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-09T06:12:33.325Z",
      "x_nadsec_last_seen": "2026-05-21T19:02:55.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--c7b76a4a-af80-4a7e-9f61-0b8361cc4cd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.7.212.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T06:28:11.451Z",
      "x_nadsec_last_seen": "2026-05-09T06:34:40.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9fe40dc0-1eef-40ba-b4cf-e7737cadc621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T06:36:27.503Z",
      "x_nadsec_last_seen": "2026-05-09T06:36:27.503Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--04274522-5976-4e2f-b515-50abad22e929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T06:46:05.967Z",
      "x_nadsec_last_seen": "2026-05-09T06:46:05.967Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--521fa0a4-8f19-440b-9059-6421608caff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.147.224.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-09T06:42:12.581Z",
      "x_nadsec_last_seen": "2026-05-18T09:22:12.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-09T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=RU; asn=44050; asn_org=Petersburg Internet Network ltd.",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:05:10.000Z",
      "valid_until": "2026-06-10T07:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-09T06:58:15.211Z",
      "x_nadsec_last_seen": "2026-05-18T08:29:30.116Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44050"
      ],
      "x_nadsec_orgs": [
        "Petersburg Internet Network ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-05-09T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5593d710-3abf-40d1-b5b0-227568c08c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.25.21.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:05:04.000Z",
      "valid_until": "2026-06-10T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T07:25:41.687Z",
      "x_nadsec_last_seen": "2026-05-09T07:25:47.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-09T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--a5e9f139-3bec-4a39-987d-b182bd81267b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.99.70.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:05:04.000Z",
      "valid_until": "2026-06-10T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T07:22:58.499Z",
      "x_nadsec_last_seen": "2026-05-09T07:23:03.966Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-09T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6075b5ca-762d-40ac-b862-3045d87e08c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:05:04.000Z",
      "valid_until": "2026-06-10T08:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T07:56:26.100Z",
      "x_nadsec_last_seen": "2026-05-09T07:56:26.100Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--ecf59402-8517-42b4-abfc-5e30461146bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.190.83.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:05:04.000Z",
      "valid_until": "2026-06-10T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T07:28:04.049Z",
      "x_nadsec_last_seen": "2026-05-09T07:30:08.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-09T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ae491f81-156f-4781-b853-30096dc5480f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.79.172.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:05:04.000Z",
      "valid_until": "2026-06-10T08:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T07:24:33.372Z",
      "x_nadsec_last_seen": "2026-05-09T07:30:57.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-09T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BJ; asn=28683; asn_org=SBIN",
      "id": "indicator--2fd18e5d-7c1e-4993-b194-a9240630572a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.85.185.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:05:04.000Z",
      "valid_until": "2026-06-10T08:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T07:34:15.839Z",
      "x_nadsec_last_seen": "2026-05-09T07:41:31.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BJ"
      ],
      "x_nadsec_asns": [
        "28683"
      ],
      "x_nadsec_orgs": [
        "SBIN"
      ]
    },
    {
      "created": "2026-05-09T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--aba167b4-91c3-4fa6-9a8e-37b6dc7052c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.57.209.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:05:04.000Z",
      "valid_until": "2026-06-10T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T07:32:16.453Z",
      "x_nadsec_last_seen": "2026-05-09T07:34:22.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--915922ba-7102-42ce-a8ed-96f6537b8d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.0.203.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T08:19:34.818Z",
      "x_nadsec_last_seen": "2026-05-09T08:21:39.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=132934; asn_org=Skymax Broadband Services Pvt. Ltd.",
      "id": "indicator--a0b89dd7-8a53-46dd-9424-b725a56056ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.199.123.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T08:36:00.652Z",
      "x_nadsec_last_seen": "2026-05-09T08:36:00.652Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132934"
      ],
      "x_nadsec_orgs": [
        "Skymax Broadband Services Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=135852; asn_org=Galaxynet Connections Private Limited",
      "id": "indicator--dd82b350-54c8-4e9e-bdc8-0d74b9e5f395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.82.156.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T08:26:54.007Z",
      "x_nadsec_last_seen": "2026-05-09T08:33:42.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135852"
      ],
      "x_nadsec_orgs": [
        "Galaxynet Connections Private Limited"
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.106.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-09T08:43:28.798Z",
      "x_nadsec_last_seen": "2026-05-09T08:47:57.740Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "445",
        "1883",
        "3306",
        "27017",
        "36201"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.202.9.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T08:17:42.866Z",
      "x_nadsec_last_seen": "2026-05-20T08:59:29.715Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=39389; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--c0d4d02a-e901-4aef-89df-965cba3dd6ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T08:30:26.263Z",
      "x_nadsec_last_seen": "2026-05-09T08:30:26.266Z",
      "x_nadsec_ports": [
        "42",
        "39389"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=57269; asn_org=Digi Spain Telecom S.A",
      "id": "indicator--2691aed2-bbfd-4fce-9523-a61484baaf41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.117.34.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T08:13:48.698Z",
      "x_nadsec_last_seen": "2026-05-09T08:13:55.135Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "57269"
      ],
      "x_nadsec_orgs": [
        "Digi Spain Telecom S.A"
      ]
    },
    {
      "created": "2026-05-09T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--8c8ea0c5-fd93-4f9d-abcd-a5e5720de004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:05:10.000Z",
      "valid_until": "2026-06-10T09:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-09T08:13:04.487Z",
      "x_nadsec_last_seen": "2026-05-09T09:08:57.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=139515; asn_org=ZITA TELECOM PRIVATE LIMITED",
      "id": "indicator--02a47589-de81-44ab-b0a9-e4a54fe5300d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.182.106.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T09:59:25.767Z",
      "x_nadsec_last_seen": "2026-05-09T10:01:30.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139515"
      ],
      "x_nadsec_orgs": [
        "ZITA TELECOM PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--5e37acd3-f0f6-4092-848f-21e216f930db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.51.175.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T09:06:09.064Z",
      "x_nadsec_last_seen": "2026-05-09T09:08:14.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--187133f8-2f27-40b1-a3af-6d5beb279878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.117.194.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-09T09:30:42.127Z",
      "x_nadsec_last_seen": "2026-05-09T11:36:39.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=45305; asn_org=Lintas Data Prima, PT",
      "id": "indicator--d2cee9ad-1e91-4b55-899e-4ab69e4adfc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.40.250.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T09:32:28.030Z",
      "x_nadsec_last_seen": "2026-05-09T09:32:28.605Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "45305"
      ],
      "x_nadsec_orgs": [
        "Lintas Data Prima, PT"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--0e81553e-613d-406c-9a7e-2812cef1e099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.234.217.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T09:56:09.672Z",
      "x_nadsec_last_seen": "2026-05-09T09:56:10.030Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--5eb056b5-c043-441c-978c-caf66435114b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.144.60.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T09:23:30.983Z",
      "x_nadsec_last_seen": "2026-05-09T09:23:34.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--67382000-d044-4eb5-9802-83d822f42e88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.109.80.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T09:38:52.816Z",
      "x_nadsec_last_seen": "2026-05-09T09:43:02.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--46b1f428-3572-4f51-beca-dbbd8ab64127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.235.220.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-09T09:06:23.163Z",
      "x_nadsec_last_seen": "2026-05-09T10:20:23.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=IR; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--b7265c66-e586-45da-b835-0e745b19b887",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T09:17:44.329Z",
      "x_nadsec_last_seen": "2026-05-09T09:17:44.876Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=59443; asn_org=Baynur and P Ltd.",
      "id": "indicator--41dc28bc-4f3e-4f07-beb8-75858e626551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.182.15.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-09T09:45:54.711Z",
      "x_nadsec_last_seen": "2026-05-17T06:00:40.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "59443"
      ],
      "x_nadsec_orgs": [
        "Baynur and P Ltd."
      ]
    },
    {
      "created": "2026-05-09T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c240c563-5972-4600-933e-dceb4ed21cd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.9.233.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:05:10.000Z",
      "valid_until": "2026-06-10T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T09:44:54.613Z",
      "x_nadsec_last_seen": "2026-05-20T11:34:49.439Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9658; asn_org=Eastern Telecoms Phils., Inc.",
      "id": "indicator--e76bce48-e854-4cf7-9ef8-efc18c380eaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.85.54.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T10:39:22.770Z",
      "x_nadsec_last_seen": "2026-05-09T10:42:59.024Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9658"
      ],
      "x_nadsec_orgs": [
        "Eastern Telecoms Phils., Inc."
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--d5ce3b57-1844-451f-aadf-011a626bc9a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.209.110.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T10:12:58.624Z",
      "x_nadsec_last_seen": "2026-05-09T10:19:46.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--5149d05a-ad63-43a3-a7b8-6c15b4168299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.230.12.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T10:41:02.365Z",
      "x_nadsec_last_seen": "2026-05-09T10:43:07.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=39; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ae7d13c3-c4b9-431e-a3a1-74f503ecf5e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.130.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 39,
      "x_nadsec_first_seen": "2026-05-09T10:24:41.810Z",
      "x_nadsec_last_seen": "2026-05-09T10:25:36.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bbf55538-edf1-46de-9680-0f8b996016d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.101.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-09T10:23:43.524Z",
      "x_nadsec_last_seen": "2026-05-09T10:23:45.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--d3cb8edf-5888-418a-93a1-30f1d01900c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.138.128.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T10:55:52.134Z",
      "x_nadsec_last_seen": "2026-05-09T10:57:59.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--2ab5b830-6156-4df5-9d44-e43334e12b52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.226.45.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T10:31:01.929Z",
      "x_nadsec_last_seen": "2026-05-09T10:31:01.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--a1c14fed-f736-4b06-a96f-6baf04373f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.9.125.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T10:55:52.514Z",
      "x_nadsec_last_seen": "2026-05-09T10:57:57.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SN; asn=37196; asn_org=SUDATEL-SENEGAL",
      "id": "indicator--f4b9d443-8238-4f8a-bb24-9bdd9cd08188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.219.61.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-09T10:41:17.401Z",
      "x_nadsec_last_seen": "2026-05-25T16:29:53.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SN"
      ],
      "x_nadsec_asns": [
        "37196"
      ],
      "x_nadsec_orgs": [
        "SUDATEL-SENEGAL"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a76720d1-1d1e-4f74-9b0c-06178247c426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T11:05:03.855Z",
      "x_nadsec_last_seen": "2026-05-09T11:05:03.855Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--27dc80f1-d2a9-48ae-87f5-bdeba2b3e788",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.120.64.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T10:37:50.221Z",
      "x_nadsec_last_seen": "2026-05-20T08:01:22.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-09T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--20db95c3-2d2d-4212-902b-9b04d7860e0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.1.116.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:05:10.000Z",
      "valid_until": "2026-06-10T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T10:08:00.841Z",
      "x_nadsec_last_seen": "2026-05-09T10:10:05.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-09T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132453; asn_org=TRIPLE PLAY BROADBAND PRIVATE LIMITED",
      "id": "indicator--e3e20926-84fc-405a-a459-30f2b62fdac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.242.86.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:05:10.000Z",
      "valid_until": "2026-06-10T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T11:20:37.920Z",
      "x_nadsec_last_seen": "2026-05-09T11:22:42.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132453"
      ],
      "x_nadsec_orgs": [
        "TRIPLE PLAY BROADBAND PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-09T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=139994; asn_org=PT XL Axiata Tbk",
      "id": "indicator--a34e329e-0cc0-4ea1-a36c-8b6c520acd04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.85.197.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:05:10.000Z",
      "valid_until": "2026-06-10T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T11:34:00.926Z",
      "x_nadsec_last_seen": "2026-05-09T11:36:05.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "139994"
      ],
      "x_nadsec_orgs": [
        "PT XL Axiata Tbk"
      ]
    },
    {
      "created": "2026-05-09T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--51aa2c80-a12a-492f-8750-9fce0d773945",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.249.129.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:05:10.000Z",
      "valid_until": "2026-06-10T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T11:42:26.788Z",
      "x_nadsec_last_seen": "2026-05-09T11:42:26.788Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--6df485d9-c5a1-4a6d-ac49-93c2b1dcd892",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.121.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T12:35:06.193Z",
      "x_nadsec_last_seen": "2026-05-09T12:37:11.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--0cab0230-dde0-4abf-ba2c-d725a3666d0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.82.74.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T12:50:46.304Z",
      "x_nadsec_last_seen": "2026-05-09T12:52:54.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-09T12:53:11.463Z",
      "x_nadsec_last_seen": "2026-05-24T19:56:18.603Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--6b54d3b1-b4e0-444d-bb67-a187bd3c7a2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.202.250.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-09T12:10:15.994Z",
      "x_nadsec_last_seen": "2026-05-09T12:11:07.621Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "0****2"
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dfb813bc-cf93-4abe-9c09-4ab7ef48a745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.83.32.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T12:27:12.519Z",
      "x_nadsec_last_seen": "2026-05-09T12:27:12.519Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--28b7e96c-17cd-40c0-a6f2-fa66abe74b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.147.139.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-09T12:57:29.226Z",
      "x_nadsec_last_seen": "2026-05-14T11:38:49.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f0565d92-a029-4eeb-869c-192a001b8c1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.34.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T12:48:33.531Z",
      "x_nadsec_last_seen": "2026-05-09T12:48:57.223Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--4a595fa3-936f-4a1e-b47d-cec4a6cc8aae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.231.148.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T12:32:26.988Z",
      "x_nadsec_last_seen": "2026-05-09T12:33:10.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DE; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--b5b3066a-2ea0-4df0-85fb-e4a7673d8b9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.171.141.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T12:46:01.965Z",
      "x_nadsec_last_seen": "2026-05-09T12:46:01.965Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--b0e5e52d-d856-4205-881d-4693dbfbff2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.168.219.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T12:14:09.564Z",
      "x_nadsec_last_seen": "2026-05-09T12:19:17.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-09T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=44664; asn_org=TOV company M-Tel",
      "id": "indicator--4869d02f-29b1-4c00-b013-bbbafb48b9d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.202.146.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:05:10.000Z",
      "valid_until": "2026-06-10T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T12:22:14.631Z",
      "x_nadsec_last_seen": "2026-05-09T12:24:20.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "44664"
      ],
      "x_nadsec_orgs": [
        "TOV company M-Tel"
      ]
    },
    {
      "created": "2026-05-09T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d3dd15f5-7b12-41c3-916f-aa299618a167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.210.134.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:05:10.000Z",
      "valid_until": "2026-06-10T14:05:09.000Z",
      "x_nadsec_event_count": 26,
      "x_nadsec_first_seen": "2026-05-09T13:23:56.983Z",
      "x_nadsec_last_seen": "2026-05-28T21:37:03.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-09T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b2c2508b-ba70-439d-8076-ebe21fd240e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.32.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:05:10.000Z",
      "valid_until": "2026-06-10T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T13:28:22.403Z",
      "x_nadsec_last_seen": "2026-05-22T18:35:17.028Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--3fc98896-5f41-4df8-8b24-638b4b3f5886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:05:10.000Z",
      "valid_until": "2026-06-10T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T13:39:05.558Z",
      "x_nadsec_last_seen": "2026-05-26T01:16:43.232Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--18fb7827-a384-4921-9682-486996033fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.44.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:05:10.000Z",
      "valid_until": "2026-06-10T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T14:00:20.093Z",
      "x_nadsec_last_seen": "2026-05-09T14:00:20.093Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.160.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T14:26:55.321Z",
      "x_nadsec_last_seen": "2026-05-09T14:27:17.234Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--04fea1e9-03de-4f8a-b35c-85e0903a7296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.83.176.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T14:05:56.624Z",
      "x_nadsec_last_seen": "2026-05-09T14:08:04.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--45074f51-34b6-48e9-bdc8-ed5103a2bb54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.172.29.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T14:53:59.820Z",
      "x_nadsec_last_seen": "2026-05-09T15:00:51.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8045e78e-ec12-43cb-9d39-3c318d36caa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.217.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T14:33:42.303Z",
      "x_nadsec_last_seen": "2026-05-09T14:33:42.810Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ea3b917c-8dcb-4cd1-9ff3-619bc3dbd406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T14:17:00.284Z",
      "x_nadsec_last_seen": "2026-05-09T14:17:00.985Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T14:07:40.904Z",
      "x_nadsec_last_seen": "2026-05-30T15:10:46.034Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f272a864-2c0c-444b-99f0-5aa65fb85e30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-09T15:01:59.218Z",
      "x_nadsec_last_seen": "2026-05-31T19:20:46.092Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-05-09T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--be65d27e-8e1a-47a1-96e7-606d03b1b3a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:05:10.000Z",
      "valid_until": "2026-06-10T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T14:33:41.730Z",
      "x_nadsec_last_seen": "2026-05-09T14:33:41.730Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-09T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=270391; asn_org=Raiznet Telecom Ltda",
      "id": "indicator--3455fa6c-1259-422a-9ba7-8e91a72f28cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.89.193.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:05:10.000Z",
      "valid_until": "2026-06-10T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T15:58:08.749Z",
      "x_nadsec_last_seen": "2026-05-09T16:00:15.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "270391"
      ],
      "x_nadsec_orgs": [
        "Raiznet Telecom Ltda"
      ]
    },
    {
      "created": "2026-05-09T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--198448a1-c2d4-4e79-a096-39dae5a4d4e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:05:10.000Z",
      "valid_until": "2026-06-10T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T15:56:56.193Z",
      "x_nadsec_last_seen": "2026-05-09T15:57:06.353Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0464ef7d-cacf-4e99-a1da-8340fb41171d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.48.19.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:05:10.000Z",
      "valid_until": "2026-06-10T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T15:14:36.719Z",
      "x_nadsec_last_seen": "2026-05-10T09:03:46.807Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-09T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--6af2a42a-a113-4e2e-84ba-de2719c59bec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.139.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:05:10.000Z",
      "valid_until": "2026-06-10T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T15:17:03.101Z",
      "x_nadsec_last_seen": "2026-05-09T15:17:20.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-09T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:05:10.000Z",
      "valid_until": "2026-06-10T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T15:20:31.301Z",
      "x_nadsec_last_seen": "2026-05-22T03:02:22.965Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-09T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--6a78b2b8-efef-4baa-a845-cb5983d8b44e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:05:10.000Z",
      "valid_until": "2026-06-10T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T15:53:46.319Z",
      "x_nadsec_last_seen": "2026-05-25T22:02:28.460Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4383c1b1-9aeb-405d-aa4f-030bf2e77fac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.134.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:05:10.000Z",
      "valid_until": "2026-06-10T16:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-09T15:11:44.204Z",
      "x_nadsec_last_seen": "2026-05-09T15:14:33.298Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--1f783f67-9d86-484f-b168-2e0b4b8e4517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.188.123.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T17:07:55.705Z",
      "x_nadsec_last_seen": "2026-05-09T17:10:02.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--760c1f4e-aaff-4f63-af30-114228d06dca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.170.250.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T17:07:13.524Z",
      "x_nadsec_last_seen": "2026-05-09T17:09:18.244Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--69756adf-e5e0-44f3-8018-1fdb3eebb250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:50:40.874Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:40.874Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--7f3c245c-d6ed-4e44-9bbe-dbf192970002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:50:41.651Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:41.651Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--d27bb77c-c588-4735-aaa2-1ec55520bdb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T17:50:54.516Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:56.009Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--acdca02b-55f2-4edc-adce-45e7686e04bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:50:59.720Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:59.720Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--5616acd8-92f6-45a0-851a-767ce0b3b220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:51:08.716Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:08.716Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--0fb22b21-223c-4447-8938-4f5f4d0dab0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:50:42.421Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:42.421Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--7d0ca0ed-38fb-4581-aa75-dffb21057ed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T17:50:47.776Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:49.282Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--8e376ab3-9858-4094-aeea-721f7a0f56f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:50:50.018Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:50.018Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--30d52800-416b-45e0-9e79-2010272a6a11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:51:10.247Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:10.247Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--0cb3c40d-c384-40f4-913a-f1b9f4623757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:50:58.969Z",
      "x_nadsec_last_seen": "2026-05-09T17:50:58.969Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--6a428de7-58d2-401c-818c-7e1e58c13555",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:51:01.233Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:01.233Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--0e920864-b835-49bf-990c-87d494898d3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T17:51:07.964Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:10.992Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--4ad20639-13ec-4749-9f9a-250fa28611fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:51:06.449Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:06.449Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=400341; asn_org=XICOMM LLC",
      "id": "indicator--4cfffaa5-4a4b-4308-afa8-9f63d434b7e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.140.216.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T17:50:40.127Z",
      "x_nadsec_last_seen": "2026-05-09T17:51:13.985Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "400341"
      ],
      "x_nadsec_orgs": [
        "XICOMM LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KG; asn=29061; asn_org=Cjsc Saima Telecom",
      "id": "indicator--2959e089-392a-454f-93af-bd1028176eff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.29.18.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T18:02:29.471Z",
      "x_nadsec_last_seen": "2026-05-09T18:09:51.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "29061"
      ],
      "x_nadsec_orgs": [
        "Cjsc Saima Telecom"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8778c30b-79e8-4717-b8c8-41c64f3558d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T17:23:17.783Z",
      "x_nadsec_last_seen": "2026-05-30T23:31:52.689Z",
      "x_nadsec_ports": [
        "1723",
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=11232; asn_org=Midcontinent Communications",
      "id": "indicator--4b0dfdb3-6e37-4cc4-b3bc-1ed70dfc4874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.45.140.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T17:49:38.048Z",
      "x_nadsec_last_seen": "2026-05-09T17:53:49.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11232"
      ],
      "x_nadsec_orgs": [
        "Midcontinent Communications"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=23158; asn_org=ETEX COMMUNICATIONS, LLC",
      "id": "indicator--776807b6-aac6-44ee-a6a1-34c69d3ed8b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.216.98.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-05-09T17:53:11.956Z",
      "x_nadsec_last_seen": "2026-05-27T06:50:40.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "23158"
      ],
      "x_nadsec_orgs": [
        "ETEX COMMUNICATIONS, LLC"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T17:17:09.245Z",
      "x_nadsec_last_seen": "2026-05-09T17:17:09.884Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--73803fb3-23d4-4dad-a609-e0a1c031aec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T17:16:42.421Z",
      "x_nadsec_last_seen": "2026-05-09T17:16:42.421Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--f35ded71-42c1-4adf-a9ce-fb43c0be8c6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.230.135.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T17:32:42.830Z",
      "x_nadsec_last_seen": "2026-05-25T02:04:47.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-05-09T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--0af70e01-b562-4e23-804d-b9a43cbaa26b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.9.135.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:05:10.000Z",
      "valid_until": "2026-06-10T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T17:18:57.940Z",
      "x_nadsec_last_seen": "2026-05-09T17:21:04.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262378; asn_org=Compuservice Empreendimentos Ltda",
      "id": "indicator--ef0c1e4c-0c86-459b-9fba-9b16471c50c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.131.29.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T18:06:20.699Z",
      "x_nadsec_last_seen": "2026-05-09T18:13:39.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262378"
      ],
      "x_nadsec_orgs": [
        "Compuservice Empreendimentos Ltda"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=205100; asn_org=F3 Netze e.V.",
      "id": "indicator--4919af2d-33a7-4dbb-8610-c884757f14b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T18:45:06.412Z",
      "x_nadsec_last_seen": "2026-05-09T18:45:06.412Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "205100"
      ],
      "x_nadsec_orgs": [
        "F3 Netze e.V."
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=205100; asn_org=F3 Netze e.V.",
      "id": "indicator--652eb7a9-3152-4525-b192-0aaea9eb4e38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T18:43:28.653Z",
      "x_nadsec_last_seen": "2026-05-09T18:43:28.653Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "205100"
      ],
      "x_nadsec_orgs": [
        "F3 Netze e.V."
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--62160e0e-6c19-45c6-828c-76c285e754bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T18:43:49.508Z",
      "x_nadsec_last_seen": "2026-05-09T18:43:50.994Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--d73b3770-92d4-4005-ae2c-e11255a0944e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T18:44:22.182Z",
      "x_nadsec_last_seen": "2026-05-09T18:44:33.726Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9a37117e-1c59-4731-89ae-40803b187201",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T18:32:40.305Z",
      "x_nadsec_last_seen": "2026-05-09T18:32:40.305Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d0b5fd85-2e89-4ced-bfe6-a9c06d02eaf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T18:32:50.552Z",
      "x_nadsec_last_seen": "2026-05-24T07:11:09.062Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=15830; asn_org=Equinix (EMEA) Acquisition Enterprises B.V.",
      "id": "indicator--38c5e946-7f25-472c-858b-2f6128e33f60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.20.27.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-09T18:40:57.132Z",
      "x_nadsec_last_seen": "2026-05-15T09:58:38.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "15830"
      ],
      "x_nadsec_orgs": [
        "Equinix (EMEA) Acquisition Enterprises B.V."
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213873; asn_org=MOJI SAS",
      "id": "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.55.81.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T18:44:00.991Z",
      "x_nadsec_last_seen": "2026-05-09T18:44:00.991Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213873"
      ],
      "x_nadsec_orgs": [
        "MOJI SAS"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mongod; ports=27017; cc=PL; asn=210895; asn_org=Podaon SIA",
      "id": "indicator--362d7368-5dc1-407e-8853-dc4e114b9ed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.162.155.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-09T18:41:21.370Z",
      "x_nadsec_last_seen": "2026-05-09T23:34:55.812Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "210895"
      ],
      "x_nadsec_orgs": [
        "Podaon SIA"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T18:44:11.127Z",
      "x_nadsec_last_seen": "2026-05-09T18:44:11.127Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--6fea38f2-48e1-4765-a27a-2d87e887fd9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T18:44:12.313Z",
      "x_nadsec_last_seen": "2026-05-09T18:44:12.313Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=httpd; ports=81; cc=NL; asn=60404; asn_org=The Infrastructure Group B.V.",
      "id": "indicator--68cc3cac-c6d8-4c03-9c34-e839fae75290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.255.118.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-09T18:44:43.705Z",
      "x_nadsec_last_seen": "2026-05-09T18:46:22.004Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "60404"
      ],
      "x_nadsec_orgs": [
        "The Infrastructure Group B.V."
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=60404; asn_org=The Infrastructure Group B.V.",
      "id": "indicator--a5e4fbd0-e2e1-4256-8f70-c4b2cfaed1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.255.98.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T18:43:38.675Z",
      "x_nadsec_last_seen": "2026-05-09T18:43:39.560Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "60404"
      ],
      "x_nadsec_orgs": [
        "The Infrastructure Group B.V."
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=10753; asn_org=Level 3 Parent, LLC",
      "id": "indicator--b12b4bf8-1c06-48fd-83bf-a753ee174704",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.243.62.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T18:43:23.605Z",
      "x_nadsec_last_seen": "2026-05-09T18:45:28.902Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10753"
      ],
      "x_nadsec_orgs": [
        "Level 3 Parent, LLC"
      ]
    },
    {
      "created": "2026-05-09T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=RO; asn=214209; asn_org=Internet Magnate (Pty) Ltd",
      "id": "indicator--ad5a47aa-785d-4b66-92be-62925acdc919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.153.138.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:05:10.000Z",
      "valid_until": "2026-06-10T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T18:46:00.055Z",
      "x_nadsec_last_seen": "2026-05-09T18:46:12.070Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "214209"
      ],
      "x_nadsec_orgs": [
        "Internet Magnate (Pty) Ltd"
      ]
    },
    {
      "created": "2026-05-09T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--25dfed67-e2d7-4bf4-a844-28deaaa5fe98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:05:10.000Z",
      "valid_until": "2026-06-10T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T19:58:06.357Z",
      "x_nadsec_last_seen": "2026-05-28T15:46:34.169Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--4c4dcae5-58fc-405f-aca1-cd2987f32d7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.115.59.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:05:10.000Z",
      "valid_until": "2026-06-10T20:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-05-09T19:16:12.505Z",
      "x_nadsec_last_seen": "2026-05-09T19:19:50.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-09T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--598ef818-d11f-407f-93bd-9543b4abc277",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.0.89.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T20:05:10.000Z",
      "valid_until": "2026-06-10T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T19:57:09.043Z",
      "x_nadsec_last_seen": "2026-05-09T19:59:58.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bee020cd-fe0d-4e5b-87ac-6dfc34ac5804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.100.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T20:20:38.441Z",
      "x_nadsec_last_seen": "2026-05-09T20:20:38.441Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--a996d7cf-2965-47d0-86e5-6340b1e8345f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.81.129.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T20:16:15.220Z",
      "x_nadsec_last_seen": "2026-05-09T20:16:15.220Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=20011; asn_org=NTT-DATA-Inc",
      "id": "indicator--39958a10-cc28-439f-9862-be38d0c6c325",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.89.8.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T20:37:18.648Z",
      "x_nadsec_last_seen": "2026-05-09T20:39:26.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "20011"
      ],
      "x_nadsec_orgs": [
        "NTT-DATA-Inc"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4ad24fb0-c143-47d1-9106-25188217aae8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T20:27:06.277Z",
      "x_nadsec_last_seen": "2026-05-09T20:27:06.606Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--ecaa2c81-43bc-4f4c-80ab-7a23a54aa417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.183.157.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T20:17:44.838Z",
      "x_nadsec_last_seen": "2026-05-09T20:18:13.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T21:02:43.297Z",
      "x_nadsec_last_seen": "2026-05-09T21:02:43.297Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=263806; asn_org=GALAXY ENTERTAINMENT DE VENEZUELA, S.C.A.",
      "id": "indicator--edea3907-6a40-46eb-82a8-44d1be477532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.74.245.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T20:15:28.920Z",
      "x_nadsec_last_seen": "2026-05-09T20:17:35.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "263806"
      ],
      "x_nadsec_orgs": [
        "GALAXY ENTERTAINMENT DE VENEZUELA, S.C.A."
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IR; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--91c0e70e-4959-4f38-adbe-0fc40746e259",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T20:16:20.833Z",
      "x_nadsec_last_seen": "2026-05-09T20:16:20.833Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-05-09T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--2b9b3316-2ede-4e81-95df-4e8a0dcd3d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.98.52.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T21:05:10.000Z",
      "valid_until": "2026-06-10T21:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-09T20:59:08.268Z",
      "x_nadsec_last_seen": "2026-05-24T18:25:46.541Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-09T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0b9888f4-1029-4b52-9cdb-6af4ea40735e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.177.112.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:05:09.000Z",
      "valid_until": "2026-06-10T22:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-09T21:05:43.468Z",
      "x_nadsec_last_seen": "2026-05-14T11:09:49.452Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-09T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e0d5ede3-d3d6-4aaa-ad8c-5b82365fe83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.112.32.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:05:09.000Z",
      "valid_until": "2026-06-10T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T22:04:58.216Z",
      "x_nadsec_last_seen": "2026-05-09T22:04:58.216Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:05:09.000Z",
      "valid_until": "2026-06-10T22:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T21:47:45.733Z",
      "x_nadsec_last_seen": "2026-05-14T23:06:09.251Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-09T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--09ec4db5-2654-4f02-b671-449d8fa99039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T22:05:09.000Z",
      "valid_until": "2026-06-10T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T21:34:00.630Z",
      "x_nadsec_last_seen": "2026-05-09T21:34:00.630Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-09T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e169f209-d2ce-4143-ae31-e1d5110921a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.168.10.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:05:13.000Z",
      "valid_until": "2026-06-10T23:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T22:38:22.019Z",
      "x_nadsec_last_seen": "2026-05-09T22:45:16.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-09T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:05:13.000Z",
      "valid_until": "2026-06-10T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T23:00:20.323Z",
      "x_nadsec_last_seen": "2026-05-18T22:47:11.641Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-05-09T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KG; asn=12764; asn_org=AKNET Ltd.; user(top)=**",
      "id": "indicator--2a3541d7-8f61-4fa7-9fd7-72a3d61b5db6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.112.108.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:05:13.000Z",
      "valid_until": "2026-06-10T23:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-09T22:17:41.920Z",
      "x_nadsec_last_seen": "2026-05-30T02:00:23.760Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12764"
      ],
      "x_nadsec_orgs": [
        "AKNET Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-09T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=RU; asn=212913; asn_org=Time-host Ltd",
      "id": "indicator--880d2242-f994-4de0-b761-76eea6654309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.131.46.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:05:13.000Z",
      "valid_until": "2026-06-10T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T22:34:23.759Z",
      "x_nadsec_last_seen": "2026-05-09T22:34:24.560Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "212913"
      ],
      "x_nadsec_orgs": [
        "Time-host Ltd"
      ]
    },
    {
      "created": "2026-05-09T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--bb33ef84-f8ef-4198-83e0-f197e442e529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:05:13.000Z",
      "valid_until": "2026-06-10T23:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-09T23:05:09.046Z",
      "x_nadsec_last_seen": "2026-05-09T23:05:09.531Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-09T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CY; asn=6866; asn_org=Cyprus Telecommunications Authority",
      "id": "indicator--b4f3f2a6-56dd-46ac-ba2b-e4793612c1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-09T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.228.138.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T23:05:13.000Z",
      "valid_until": "2026-06-10T23:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T22:34:48.084Z",
      "x_nadsec_last_seen": "2026-05-09T22:34:48.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "6866"
      ],
      "x_nadsec_orgs": [
        "Cyprus Telecommunications Authority"
      ]
    },
    {
      "created": "2026-05-10T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:05:10.000Z",
      "valid_until": "2026-06-11T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T23:51:51.405Z",
      "x_nadsec_last_seen": "2026-05-15T01:39:42.954Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--9e455ada-bbf4-4a54-a53b-658b24e8cf91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.95.27.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:05:10.000Z",
      "valid_until": "2026-06-11T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T00:04:39.803Z",
      "x_nadsec_last_seen": "2026-05-10T00:06:45.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-10T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--13ad029e-179b-4150-b1c3-9bdaf844f78d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.14.21.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:05:10.000Z",
      "valid_until": "2026-06-11T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-09T23:44:03.260Z",
      "x_nadsec_last_seen": "2026-05-09T23:44:03.260Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--60ebc9a9-d465-411d-b82e-1ca917c16aba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.87.12.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:05:10.000Z",
      "valid_until": "2026-06-11T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T00:04:10.391Z",
      "x_nadsec_last_seen": "2026-05-10T00:04:10.391Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-10T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fcd051c9-5ff7-402c-8335-50615967063d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.235.185.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T00:05:10.000Z",
      "valid_until": "2026-06-11T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T23:52:20.208Z",
      "x_nadsec_last_seen": "2026-05-09T23:52:30.399Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b754aaea-04a7-45f5-a807-297127266265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T00:07:06.206Z",
      "x_nadsec_last_seen": "2026-05-10T00:07:06.634Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3ae42fd2-21bf-4d0b-af52-2bfe77481271",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.93.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T00:34:33.287Z",
      "x_nadsec_last_seen": "2026-05-10T00:34:33.287Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--cb0a7bbd-9cf1-40ff-bc1f-83f7fb4b3264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.200.235.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T00:50:23.396Z",
      "x_nadsec_last_seen": "2026-05-16T11:08:56.568Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--ae302535-26fc-493f-a530-761fdc9e581a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.125.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T00:37:13.919Z",
      "x_nadsec_last_seen": "2026-05-10T00:39:18.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--dafea66d-47bf-4381-bb43-0de1727e26ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.67.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T00:38:09.068Z",
      "x_nadsec_last_seen": "2026-05-10T00:38:09.068Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5a3ba493-2f0d-4450-bc8a-2d421d9414ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.22.172.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T00:21:01.868Z",
      "x_nadsec_last_seen": "2026-05-21T12:52:58.234Z",
      "x_nadsec_ports": [
        "21",
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=131386; asn_org=Long Van System Solution JSC",
      "id": "indicator--b412b98f-1173-4963-8f5e-dd89143b43f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.119.87.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T00:24:32.557Z",
      "x_nadsec_last_seen": "2026-05-18T13:04:38.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "131386"
      ],
      "x_nadsec_orgs": [
        "Long Van System Solution JSC"
      ]
    },
    {
      "created": "2026-05-10T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b648c2e2-870a-44cc-92c1-55da36f0b757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:05:10.000Z",
      "valid_until": "2026-06-11T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T00:33:54.585Z",
      "x_nadsec_last_seen": "2026-05-10T00:33:54.585Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2902f653-669c-40bb-9a09-9f8ae4796565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.164.66.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T01:13:30.164Z",
      "x_nadsec_last_seen": "2026-05-30T09:48:38.736Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--224599bb-f1d5-425a-bab6-fa44db6f4491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.253.96.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T01:09:58.505Z",
      "x_nadsec_last_seen": "2026-05-10T01:59:38.062Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--141884cd-e438-4a23-b3ee-d926d95d81ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.163.173.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T01:12:16.034Z",
      "x_nadsec_last_seen": "2026-05-19T02:25:42.648Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2e8a4d74-9f3c-4c4e-be91-fd7b297fd212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.106.206.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T01:50:25.133Z",
      "x_nadsec_last_seen": "2026-05-10T01:50:35.334Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=264023; asn_org=SE77E TELECOM EIRELI ME",
      "id": "indicator--1580ede7-1881-4a52-893a-67cd9fbfd476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.191.125.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T01:14:12.553Z",
      "x_nadsec_last_seen": "2026-05-10T01:14:12.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264023"
      ],
      "x_nadsec_orgs": [
        "SE77E TELECOM EIRELI ME"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--c1f332bf-c0d5-4b04-8170-616da1fba7ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.255.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T01:25:11.626Z",
      "x_nadsec_last_seen": "2026-05-10T01:25:11.626Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T01:14:46.015Z",
      "x_nadsec_last_seen": "2026-05-29T12:33:29.564Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "135",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--494d2ce0-3304-4b2c-8a63-39e59aa29ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T01:56:27.864Z",
      "x_nadsec_last_seen": "2026-05-10T01:56:27.864Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5323a6fd-f1f4-43c9-a792-19fe3c7d1aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T01:56:07.097Z",
      "x_nadsec_last_seen": "2026-05-10T01:56:07.097Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6e168316-2bed-49cb-8016-2ad5ecba3c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T01:56:38.207Z",
      "x_nadsec_last_seen": "2026-05-10T01:56:38.207Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6e89de6d-2896-4118-82d2-5be9858a0d7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:05:10.000Z",
      "valid_until": "2026-06-11T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T01:56:06.757Z",
      "x_nadsec_last_seen": "2026-05-10T01:56:06.757Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--61ee3903-0482-48c0-934c-a83ccf71a139",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.129.65.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T02:41:05.849Z",
      "x_nadsec_last_seen": "2026-05-10T02:41:05.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--08aadb53-f162-49cc-8797-6f3025a549f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.210.157.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T02:30:07.484Z",
      "x_nadsec_last_seen": "2026-05-10T02:30:08.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--81af44b5-2670-48c1-9e47-a6bd59cf7d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.211.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T02:43:38.175Z",
      "x_nadsec_last_seen": "2026-05-10T02:44:13.992Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--3eabe2e2-4451-48f3-8909-1de47b7f0bd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.205.163.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T02:43:36.374Z",
      "x_nadsec_last_seen": "2026-05-10T02:43:36.374Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--122de781-de74-427e-a318-706de79deb68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.117.202.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T02:28:03.675Z",
      "x_nadsec_last_seen": "2026-05-10T02:28:03.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57227; asn_org=Subnet LLC",
      "id": "indicator--4c1bd3a1-4435-4770-85fc-0bcd3f3b4097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.163.39.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T02:32:07.490Z",
      "x_nadsec_last_seen": "2026-05-10T02:33:23.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57227"
      ],
      "x_nadsec_orgs": [
        "Subnet LLC"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--8b70edaa-e0b8-4a51-acfb-d9dc5d1575e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T02:16:28.714Z",
      "x_nadsec_last_seen": "2026-05-10T17:25:46.557Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=21499; asn_org=Host Europe GmbH",
      "id": "indicator--03561ffe-f6e0-492e-a515-04235aee8c21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.205.183.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T02:34:44.156Z",
      "x_nadsec_last_seen": "2026-05-10T02:34:44.156Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "21499"
      ],
      "x_nadsec_orgs": [
        "Host Europe GmbH"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--3e69a12e-6a9a-4a72-af5e-6e038869f53d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.188.87.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T02:24:29.014Z",
      "x_nadsec_last_seen": "2026-05-10T02:32:26.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-10T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--0f5d11ca-005b-4994-8f79-cb07808db844",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.57.218.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:05:02.000Z",
      "valid_until": "2026-06-11T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T02:43:38.710Z",
      "x_nadsec_last_seen": "2026-05-10T02:43:38.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--0092494a-115b-4802-bcec-1d9ccf3d5411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.188.122.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T03:25:44.093Z",
      "x_nadsec_last_seen": "2026-05-10T03:27:51.900Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=20; services=mysqld; ports=3306; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c8f58590-b381-4b8a-a1a1-e08628db21c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.146.110.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 60,
      "x_nadsec_first_seen": "2026-05-10T03:32:22.463Z",
      "x_nadsec_last_seen": "2026-05-28T19:54:17.418Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--0b7b679b-d407-42c5-9171-610f4122e166",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.187.124.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T03:16:49.402Z",
      "x_nadsec_last_seen": "2026-05-10T03:16:49.402Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f0185068-64a6-4459-8190-54c51cafb51e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.177.206.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T03:51:30.972Z",
      "x_nadsec_last_seen": "2026-05-10T03:56:07.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4573eb6d-4897-48a8-a88a-436106ee9a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T03:46:17.053Z",
      "x_nadsec_last_seen": "2026-05-10T03:46:17.053Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7e097f91-2e79-45f4-a676-889a8d735450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T03:57:46.984Z",
      "x_nadsec_last_seen": "2026-05-10T03:57:46.984Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=52963; asn_org=JATIMNET TELECOM",
      "id": "indicator--1a2a53ab-e9eb-467f-8312-7fa75b044a8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.150.24.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T03:25:00.018Z",
      "x_nadsec_last_seen": "2026-05-10T03:25:00.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52963"
      ],
      "x_nadsec_orgs": [
        "JATIMNET TELECOM"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a443f2ce-5f7d-4e8d-a1f6-0799c5e88f32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T03:16:49.164Z",
      "x_nadsec_last_seen": "2026-05-10T03:16:49.164Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--501e5bd6-b178-486f-96e2-f2bb5ee9a257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.229.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T03:09:47.362Z",
      "x_nadsec_last_seen": "2026-05-10T19:52:04.064Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a7ea87b9-e833-4ff8-afbe-3fdb6cfaa1c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.199.82.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T03:09:35.452Z",
      "x_nadsec_last_seen": "2026-05-10T03:09:46.740Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9b6f6355-c381-4621-a7f5-e5c2e6f1d017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T03:31:38.351Z",
      "x_nadsec_last_seen": "2026-05-16T00:34:57.841Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--69813e44-9fa4-4a07-bdf0-08de408164f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.29.110.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T03:08:26.256Z",
      "x_nadsec_last_seen": "2026-05-10T03:16:23.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30848; asn_org=UNIDATA S.p.A.",
      "id": "indicator--8f101f7e-442c-450c-96ad-8d41309d0bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.217.182.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T03:50:16.212Z",
      "x_nadsec_last_seen": "2026-05-23T04:50:45.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30848"
      ],
      "x_nadsec_orgs": [
        "UNIDATA S.p.A."
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--11eefabd-8ded-4182-82a9-9aa17ed78959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T04:04:47.376Z",
      "x_nadsec_last_seen": "2026-05-10T04:04:47.376Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1004736e-7686-47da-922c-5bf6c1369d53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T04:04:47.183Z",
      "x_nadsec_last_seen": "2026-05-10T04:04:47.183Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T04:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d2a040a1-7214-4a6c-8eea-5b30439d4d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T04:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:05:09.000Z",
      "valid_until": "2026-06-11T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T04:04:09.011Z",
      "x_nadsec_last_seen": "2026-05-10T04:04:09.150Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--227a99a5-0b61-405c-aadf-e23474807352",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.134.206.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:05:12.000Z",
      "valid_until": "2026-06-11T05:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T04:08:06.264Z",
      "x_nadsec_last_seen": "2026-05-10T04:15:08.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-05-10T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9c15c10a-072a-409e-b447-d682d44914f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:05:12.000Z",
      "valid_until": "2026-06-11T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T04:25:25.962Z",
      "x_nadsec_last_seen": "2026-05-10T04:25:36.363Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--71aab60a-1ac4-47f2-ae17-f5e0376dd1aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:05:12.000Z",
      "valid_until": "2026-06-11T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T04:33:45.199Z",
      "x_nadsec_last_seen": "2026-05-10T04:33:45.488Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9e3a779b-8e44-423e-80ca-d3ec34bbdd83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:05:12.000Z",
      "valid_until": "2026-06-11T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T04:52:41.926Z",
      "x_nadsec_last_seen": "2026-05-10T04:52:41.926Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MY; asn=38466; asn_org=U Mobile Sdn Bhd",
      "id": "indicator--f476b8ea-dde1-451c-b327-1a8a16b9e823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.125.251.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:05:12.000Z",
      "valid_until": "2026-06-11T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T04:16:23.330Z",
      "x_nadsec_last_seen": "2026-05-10T04:16:23.330Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "38466"
      ],
      "x_nadsec_orgs": [
        "U Mobile Sdn Bhd"
      ]
    },
    {
      "created": "2026-05-10T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24758; asn_org=Mikroel Ltd",
      "id": "indicator--3397a1fc-4ddb-45fd-baff-1fc1eccc10fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.157.22.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:05:12.000Z",
      "valid_until": "2026-06-11T05:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T04:38:55.663Z",
      "x_nadsec_last_seen": "2026-05-10T04:46:29.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24758"
      ],
      "x_nadsec_orgs": [
        "Mikroel Ltd"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=132453; asn_org=TRIPLE PLAY BROADBAND PRIVATE LIMITED",
      "id": "indicator--7c83910a-9f18-409c-a1b1-656ad195a603",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.227.68.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T05:47:28.787Z",
      "x_nadsec_last_seen": "2026-05-25T05:25:29.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132453"
      ],
      "x_nadsec_orgs": [
        "TRIPLE PLAY BROADBAND PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--eae7e5db-61ed-440e-b496-6f803f607663",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.155.72.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T05:09:26.703Z",
      "x_nadsec_last_seen": "2026-05-10T06:56:38.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--dd49ac26-b46a-4f8e-89de-b6c19045e73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T05:26:45.753Z",
      "x_nadsec_last_seen": "2026-05-10T05:26:45.753Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--fd31b657-f057-4bf8-9246-aea15ae42f4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.187.48.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-10T05:15:12.306Z",
      "x_nadsec_last_seen": "2026-05-27T05:52:54.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9e4e1984-561a-4456-853f-bea66f459852",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T05:45:09.735Z",
      "x_nadsec_last_seen": "2026-05-10T05:45:09.735Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--febbebd8-b5f1-41f9-8623-ec5e32608935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T05:45:08.288Z",
      "x_nadsec_last_seen": "2026-05-10T05:45:08.288Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f05308ba-132e-4bd3-8822-28e4e6512c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T05:31:09.266Z",
      "x_nadsec_last_seen": "2026-05-14T02:58:25.924Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9e6677d0-be36-4e8e-9389-932fae7b5832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T05:31:19.706Z",
      "x_nadsec_last_seen": "2026-05-10T05:31:19.706Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T06:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2a3558b1-8c25-45ec-83bf-aad830258650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T06:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '97.107.131.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:05:15.000Z",
      "valid_until": "2026-06-11T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T05:40:28.172Z",
      "x_nadsec_last_seen": "2026-05-10T05:40:28.172Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=134877; asn_org=Sri Vari Network Private Limited",
      "id": "indicator--a3017d25-21da-4a9e-81f3-07660d7b9860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.124.153.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T07:04:42.392Z",
      "x_nadsec_last_seen": "2026-05-10T07:54:29.022Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134877"
      ],
      "x_nadsec_orgs": [
        "Sri Vari Network Private Limited"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135756; asn_org=VPS Broadband And Telecommunications Pvt Ltd",
      "id": "indicator--ed329407-60f4-4fee-9f2e-2512f1226a0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.74.169.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T06:54:45.513Z",
      "x_nadsec_last_seen": "2026-05-10T06:56:50.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135756"
      ],
      "x_nadsec_orgs": [
        "VPS Broadband And Telecommunications Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AF; asn=55330; asn_org=AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK",
      "id": "indicator--d03108da-a26a-4f0c-9c8f-b40dfbe32d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.54.17.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T06:55:56.325Z",
      "x_nadsec_last_seen": "2026-05-10T06:55:56.624Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AF"
      ],
      "x_nadsec_asns": [
        "55330"
      ],
      "x_nadsec_orgs": [
        "AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AF; asn=55330; asn_org=AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK",
      "id": "indicator--36814de5-0e47-4025-a2de-e04b22b4d440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.54.17.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T06:58:01.224Z",
      "x_nadsec_last_seen": "2026-05-10T06:58:03.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AF"
      ],
      "x_nadsec_asns": [
        "55330"
      ],
      "x_nadsec_orgs": [
        "AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8e2dbca8-67a4-4f28-afdf-d914b756611c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.203.121.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T06:52:31.148Z",
      "x_nadsec_last_seen": "2026-05-10T06:52:31.148Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PY; asn=23201; asn_org=Telecel S.A.",
      "id": "indicator--5cac01b6-92cf-4c84-bc7d-523f408bb9de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.16.13.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T06:53:52.500Z",
      "x_nadsec_last_seen": "2026-05-25T07:40:36.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "23201"
      ],
      "x_nadsec_orgs": [
        "Telecel S.A."
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--4db030cc-b9a7-42d5-8b9d-7aeadc3f49f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.49.125.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T06:14:53.249Z",
      "x_nadsec_last_seen": "2026-05-10T06:22:20.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--b819eb99-f2bc-400c-9181-e0445d150130",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.239.78.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T06:34:35.211Z",
      "x_nadsec_last_seen": "2026-05-10T06:35:59.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--045662a0-d19d-4ce2-87fc-70b404059e8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.138.199.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T06:58:23.764Z",
      "x_nadsec_last_seen": "2026-05-10T07:00:45.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--1b23815e-f825-48aa-b621-fb3322f19520",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.7.157.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T06:06:33.815Z",
      "x_nadsec_last_seen": "2026-05-10T06:13:50.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=21483; asn_org=PVimpelCom",
      "id": "indicator--31b1cb4b-44d7-4989-903e-af6e53f6f53e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.255.138.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T06:15:05.069Z",
      "x_nadsec_last_seen": "2026-05-10T06:17:12.919Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21483"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-10T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ES; asn=8560; asn_org=IONOS SE; user(top)=**",
      "id": "indicator--07253028-fa65-4337-825e-d0d58b1f5ec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.223.16.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:05:11.000Z",
      "valid_until": "2026-06-11T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T06:43:58.537Z",
      "x_nadsec_last_seen": "2026-05-10T06:43:58.537Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "8560"
      ],
      "x_nadsec_orgs": [
        "IONOS SE"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b0ade785-344b-424f-9d5e-d1ded8521103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.160.26.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:05:08.000Z",
      "valid_until": "2026-06-11T08:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T07:15:14.452Z",
      "x_nadsec_last_seen": "2026-05-10T07:19:36.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-10T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--00da883a-cf24-4386-99cf-4baa956408a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.100.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:05:08.000Z",
      "valid_until": "2026-06-11T08:05:06.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-05-10T07:20:13.184Z",
      "x_nadsec_last_seen": "2026-05-30T22:45:02.910Z",
      "x_nadsec_ports": [
        "135",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1e7246cc-c279-4763-b113-c14988aef92f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.214.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:05:08.000Z",
      "valid_until": "2026-06-11T08:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T07:32:23.933Z",
      "x_nadsec_last_seen": "2026-05-10T07:32:23.933Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--31c01f0a-0449-4b76-a1b7-f4ae1c48a55e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.155.90.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:05:08.000Z",
      "valid_until": "2026-06-11T08:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T07:17:21.582Z",
      "x_nadsec_last_seen": "2026-05-10T07:17:51.583Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-10T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:05:08.000Z",
      "valid_until": "2026-06-11T08:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T07:36:39.285Z",
      "x_nadsec_last_seen": "2026-05-10T07:36:39.285Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5507462e-ffcd-43b5-bfe6-afe98d5d4eba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.119.99.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T08:40:24.662Z",
      "x_nadsec_last_seen": "2026-05-10T08:40:34.861Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c09a464a-3ec3-4295-853c-4aa1527e0dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.164.41.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T08:28:27.285Z",
      "x_nadsec_last_seen": "2026-05-10T08:30:34.759Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--f95f2284-6554-42ee-aa07-9f498265aff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.72.152.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T08:42:18.343Z",
      "x_nadsec_last_seen": "2026-05-10T08:44:27.747Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--b163ed59-c615-4fae-8a5d-b5ed5ae896f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.1.143.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T08:12:31.387Z",
      "x_nadsec_last_seen": "2026-05-10T08:33:09.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.193.119.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T08:39:26.686Z",
      "x_nadsec_last_seen": "2026-05-25T04:55:55.877Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=196742; asn_org=LLC Ekran",
      "id": "indicator--acc7b7b8-9079-4434-b19b-16969af8a640",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.220.155.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T08:19:07.960Z",
      "x_nadsec_last_seen": "2026-05-10T08:21:14.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "196742"
      ],
      "x_nadsec_orgs": [
        "LLC Ekran"
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fd48da17-b586-40a8-bd12-88dce263f83d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.131.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T09:03:44.876Z",
      "x_nadsec_last_seen": "2026-05-10T09:03:44.876Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--0d7e126f-1001-4411-b1fe-c73cdc2329fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.30.196.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:05:11.000Z",
      "valid_until": "2026-06-11T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T08:59:42.380Z",
      "x_nadsec_last_seen": "2026-05-10T09:01:49.057Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LY; asn=37284; asn_org=Aljeel-net",
      "id": "indicator--1964b692-dcf2-475e-a53e-267db264f4d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.16.116.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 721,
      "x_nadsec_first_seen": "2026-05-10T09:07:38.473Z",
      "x_nadsec_last_seen": "2026-05-10T11:59:02.982Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LY"
      ],
      "x_nadsec_asns": [
        "37284"
      ],
      "x_nadsec_orgs": [
        "Aljeel-net"
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--c5b2de4e-b12f-46a8-a34d-f5a5cc07cc4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.61.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T09:30:36.317Z",
      "x_nadsec_last_seen": "2026-05-16T12:39:31.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T09:09:59.690Z",
      "x_nadsec_last_seen": "2026-05-31T05:07:21.292Z",
      "x_nadsec_ports": [
        "21",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--13b4fda0-522a-46aa-875f-d38173d12119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.145.157.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T09:43:43.872Z",
      "x_nadsec_last_seen": "2026-05-10T09:45:51.336Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12668; asn_org=LLC KomTehCentr",
      "id": "indicator--3e8f48b0-45d8-4dbb-aa0f-b0541548e723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.48.24.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T09:46:42.746Z",
      "x_nadsec_last_seen": "2026-05-10T09:48:49.732Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12668"
      ],
      "x_nadsec_orgs": [
        "LLC KomTehCentr"
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--55ff3074-82cd-44a8-b7b0-9038a393c6ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.174.84.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-10T09:19:09.193Z",
      "x_nadsec_last_seen": "2026-05-16T06:20:33.223Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--526f3a43-20d1-4973-aa2c-a8c51123cc05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T09:37:49.785Z",
      "x_nadsec_last_seen": "2026-05-14T05:58:30.779Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--1c794c87-8af9-4bb4-a521-47202ca883b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.43.187.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:05:10.000Z",
      "valid_until": "2026-06-11T10:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T09:07:53.423Z",
      "x_nadsec_last_seen": "2026-05-10T09:15:45.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-10T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--ddde6ae4-5ce0-4321-8984-bb42e07e5bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.0.210.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:05:05.000Z",
      "valid_until": "2026-06-11T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T10:27:32.505Z",
      "x_nadsec_last_seen": "2026-05-10T10:29:37.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-10T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--151e68d8-0a70-4f5c-84b7-6aa45aec59b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.241.104.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:05:05.000Z",
      "valid_until": "2026-06-11T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T10:44:15.092Z",
      "x_nadsec_last_seen": "2026-05-10T10:46:19.972Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-10T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--82a0ec13-c874-4549-8024-3e14f40975f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.122.119.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:05:05.000Z",
      "valid_until": "2026-06-11T11:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T10:12:05.776Z",
      "x_nadsec_last_seen": "2026-05-10T10:12:06.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-10T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:05:05.000Z",
      "valid_until": "2026-06-11T11:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-10T10:57:44.190Z",
      "x_nadsec_last_seen": "2026-05-31T12:50:01.168Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-10T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=59165; asn_org=Auspice Infratel Pvt. Ltd.",
      "id": "indicator--906eb17e-e7b9-436b-a83c-2097a14aacb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.229.225.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:05:05.000Z",
      "valid_until": "2026-06-11T11:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T10:17:22.791Z",
      "x_nadsec_last_seen": "2026-05-25T10:14:47.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59165"
      ],
      "x_nadsec_orgs": [
        "Auspice Infratel Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17625; asn_org=BlazeNets Network",
      "id": "indicator--7e5cfe02-7130-4ed0-b6ed-4074012e4467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.19.134.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-05-10T11:29:54.004Z",
      "x_nadsec_last_seen": "2026-05-31T09:53:55.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17625"
      ],
      "x_nadsec_orgs": [
        "BlazeNets Network"
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=45899; asn_org=VNPT Corp; user(top)=**",
      "id": "indicator--e3c77720-09a1-4870-9d2d-871d4f382ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.181.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T11:09:12.471Z",
      "x_nadsec_last_seen": "2026-05-10T11:09:12.471Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--6692967d-bfdc-4172-9af0-95ff97caf6cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T11:08:13.716Z",
      "x_nadsec_last_seen": "2026-05-13T22:05:13.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--f321b47a-fc06-4da8-b08a-c459a5ad4c86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.53.222.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T11:37:02.240Z",
      "x_nadsec_last_seen": "2026-05-10T11:39:07.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--e1ce5c37-41ad-49bc-b6a2-ae2a6f61fac2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.96.151.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-10T11:42:34.688Z",
      "x_nadsec_last_seen": "2026-05-29T09:18:15.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--c4297078-22c9-45ee-8bab-97a581b55562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.188.118.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-10T11:37:50.731Z",
      "x_nadsec_last_seen": "2026-05-29T09:18:14.421Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--932d5913-a980-475b-926c-e104684c45e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T11:37:09.307Z",
      "x_nadsec_last_seen": "2026-05-10T11:37:09.658Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--15b59443-2e21-4670-be30-8f69160e884d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.28.130.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:05:10.000Z",
      "valid_until": "2026-06-11T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T11:16:17.573Z",
      "x_nadsec_last_seen": "2026-05-10T11:16:17.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-05-10T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6c23d75e-1086-4e30-b06d-a2a05892f37a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.26.100.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:05:05.000Z",
      "valid_until": "2026-06-11T13:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T12:50:40.778Z",
      "x_nadsec_last_seen": "2026-05-10T12:57:10.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-10T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7b1260cc-5468-46ad-b591-b55d7105d0e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.60.122.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:05:05.000Z",
      "valid_until": "2026-06-11T13:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T12:16:02.685Z",
      "x_nadsec_last_seen": "2026-05-27T20:54:27.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-10T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc; user(top)=**",
      "id": "indicator--fc9b8439-7867-4bb3-9d59-5c96e344c47e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.165.229.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:05:05.000Z",
      "valid_until": "2026-06-11T13:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T12:09:09.178Z",
      "x_nadsec_last_seen": "2026-05-10T12:09:09.178Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:05:05.000Z",
      "valid_until": "2026-06-11T13:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T13:01:26.202Z",
      "x_nadsec_last_seen": "2026-05-30T12:30:39.586Z",
      "x_nadsec_ports": [
        "135",
        "81",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-10T13:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--cc15a2a0-e7d0-4958-93fd-5109b8ef3183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T13:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.190.244.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:05:05.000Z",
      "valid_until": "2026-06-11T13:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T12:55:46.469Z",
      "x_nadsec_last_seen": "2026-05-10T12:57:53.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ba6c918b-f5af-484c-9d09-0911227dc4ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.162.27.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:05:10.000Z",
      "valid_until": "2026-06-11T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T13:53:13.501Z",
      "x_nadsec_last_seen": "2026-05-10T13:55:18.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--fbc34aff-9262-4de5-912d-77baeba0665e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.160.179.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:05:10.000Z",
      "valid_until": "2026-06-11T14:05:08.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-10T13:21:59.866Z",
      "x_nadsec_last_seen": "2026-05-10T13:24:43.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-05-10T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--207ab1dd-982c-4464-8a93-cd5d0b6693c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.10.19.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T14:05:10.000Z",
      "valid_until": "2026-06-11T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T13:45:25.092Z",
      "x_nadsec_last_seen": "2026-05-10T13:47:31.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=141688; asn_org=Telangana Fiber Grid Corporation Limited",
      "id": "indicator--adbd99c1-f400-46a8-9c2d-676713f9a13f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.91.190.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:05:10.000Z",
      "valid_until": "2026-06-11T15:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-10T14:12:42.700Z",
      "x_nadsec_last_seen": "2026-05-27T22:53:55.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141688"
      ],
      "x_nadsec_orgs": [
        "Telangana Fiber Grid Corporation Limited"
      ]
    },
    {
      "created": "2026-05-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--91d5dcb6-ce35-4bf9-a753-134f7249feb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.201.192.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:05:10.000Z",
      "valid_until": "2026-06-11T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T14:56:13.305Z",
      "x_nadsec_last_seen": "2026-05-10T14:58:19.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--38be71c5-9f7c-4766-b6ab-983aff75ee4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.129.124.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:05:10.000Z",
      "valid_until": "2026-06-11T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T14:29:19.171Z",
      "x_nadsec_last_seen": "2026-05-10T14:29:19.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-05-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:05:10.000Z",
      "valid_until": "2026-06-11T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T14:37:23.470Z",
      "x_nadsec_last_seen": "2026-05-23T03:31:46.960Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:05:10.000Z",
      "valid_until": "2026-06-11T15:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-10T14:14:16.222Z",
      "x_nadsec_last_seen": "2026-05-28T01:14:32.249Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-10T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--4c5bbbe8-f2ae-4ee0-bfac-c78e927b87fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:05:10.000Z",
      "valid_until": "2026-06-11T15:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-10T15:04:10.591Z",
      "x_nadsec_last_seen": "2026-05-10T15:04:32.384Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-10T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--86003089-ec21-488e-8b57-06531026f170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.222.214.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:05:07.000Z",
      "valid_until": "2026-06-11T16:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T15:27:23.290Z",
      "x_nadsec_last_seen": "2026-05-10T15:34:39.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-10T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--9719bb5a-4bc8-4719-a760-c28c8b10df33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.103.230.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:05:07.000Z",
      "valid_until": "2026-06-11T16:05:03.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-10T15:13:37.932Z",
      "x_nadsec_last_seen": "2026-05-28T01:51:55.555Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-10T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--51d69f4d-b9ea-47cc-982b-5ac873c7439c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.46.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:05:07.000Z",
      "valid_until": "2026-06-11T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T15:17:17.171Z",
      "x_nadsec_last_seen": "2026-05-10T15:19:23.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-10T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--d347406c-35b2-43e1-bed4-4374baea97e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.0.99.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:05:07.000Z",
      "valid_until": "2026-06-11T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T15:49:23.222Z",
      "x_nadsec_last_seen": "2026-05-10T15:51:30.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-10T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--9c1a5b3f-f6ad-41cd-a5f9-0baa332d6833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.223.14.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:05:07.000Z",
      "valid_until": "2026-06-11T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T15:52:47.978Z",
      "x_nadsec_last_seen": "2026-05-10T15:54:54.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-10T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--fb6ade18-8ec9-4eff-bdfb-f174caa0d913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.251.72.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:05:07.000Z",
      "valid_until": "2026-06-11T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T15:21:36.964Z",
      "x_nadsec_last_seen": "2026-05-10T15:21:38.379Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:05:07.000Z",
      "valid_until": "2026-06-11T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T15:17:16.624Z",
      "x_nadsec_last_seen": "2026-05-10T15:17:16.624Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--0c9e6e71-7e2b-48d5-af47-2bf19914315d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.118.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T16:33:08.109Z",
      "x_nadsec_last_seen": "2026-05-10T16:35:15.752Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=401701; asn_org=cognetcloud INC",
      "id": "indicator--f23e2d14-9295-4727-89ed-d8c7a194215e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.52.154.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T16:38:23.120Z",
      "x_nadsec_last_seen": "2026-05-10T16:38:23.331Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "401701"
      ],
      "x_nadsec_orgs": [
        "cognetcloud INC"
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company; user(top)=**",
      "id": "indicator--8ed975b2-8ca6-42b4-9a8b-e41527d5e244",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.54.143.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T16:37:07.278Z",
      "x_nadsec_last_seen": "2026-05-10T16:37:07.278Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=44613; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--6c166492-8271-4b04-816d-4587efbc9e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T16:25:29.301Z",
      "x_nadsec_last_seen": "2026-05-12T20:39:54.573Z",
      "x_nadsec_ports": [
        "42",
        "445",
        "1433",
        "44613"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T16:15:18.903Z",
      "x_nadsec_last_seen": "2026-05-10T16:15:18.903Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--a59c77d9-af0b-4cca-bf0b-025ebe455113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.32.27.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T16:59:43.807Z",
      "x_nadsec_last_seen": "2026-05-10T16:59:50.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--6bcfb678-d402-4a1d-a2b6-b44170404cfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.233.42.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T16:07:33.758Z",
      "x_nadsec_last_seen": "2026-05-28T11:03:33.334Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b045b636-056f-4f24-88b8-149fa7f12ecf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:05:10.000Z",
      "valid_until": "2026-06-11T17:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T16:30:40.213Z",
      "x_nadsec_last_seen": "2026-05-31T23:44:47.484Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5d9580bd-32be-4fb8-82e1-2f5e6f69decf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.156.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T18:13:42.439Z",
      "x_nadsec_last_seen": "2026-05-10T18:14:01.527Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--548186a9-42d8-431f-8347-9af95df54cdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.235.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T18:43:54.969Z",
      "x_nadsec_last_seen": "2026-05-10T18:44:15.165Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--98b55d91-a867-4aec-af5e-98fe546a9b76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.69.129.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T18:50:27.813Z",
      "x_nadsec_last_seen": "2026-05-10T18:52:34.739Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=202254; asn_org=Lifecell Digital Ltd; user(top)=**",
      "id": "indicator--0fe19022-8a21-4162-b980-9ded0d33b49d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.108.130.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T18:55:16.248Z",
      "x_nadsec_last_seen": "2026-05-25T02:48:27.795Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "202254"
      ],
      "x_nadsec_orgs": [
        "Lifecell Digital Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--106a62c4-babd-4a76-9310-58e534904e74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.65.30.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T18:48:52.828Z",
      "x_nadsec_last_seen": "2026-05-10T18:50:59.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d06af509-7531-4e4e-9dc1-859b17042426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T18:32:04.207Z",
      "x_nadsec_last_seen": "2026-05-10T18:32:04.207Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=LB; asn=43019; asn_org=Farah Net S.a.r.l.; user(top)=**",
      "id": "indicator--78342350-476a-434a-b037-d9ab40aab793",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.75.93.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T18:28:28.355Z",
      "x_nadsec_last_seen": "2026-05-10T18:28:28.355Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "LB"
      ],
      "x_nadsec_asns": [
        "43019"
      ],
      "x_nadsec_orgs": [
        "Farah Net S.a.r.l."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e258f438-7d8b-46ca-9421-40bdf06f3df3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.208.107.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T19:02:29.322Z",
      "x_nadsec_last_seen": "2026-05-10T19:04:36.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--65610f03-a81d-42b4-a28c-7238d7a6f0f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T18:07:28.551Z",
      "x_nadsec_last_seen": "2026-05-25T19:32:32.434Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--98d9dde2-c1f7-4f71-a2e2-bd92be51898f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T18:07:27.898Z",
      "x_nadsec_last_seen": "2026-05-10T18:07:27.898Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NL; asn=1136; asn_org=KPN B.V.",
      "id": "indicator--0149d211-de44-4cb1-9956-2241f21d4d07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.64.152.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T18:19:20.267Z",
      "x_nadsec_last_seen": "2026-05-10T18:21:25.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "1136"
      ],
      "x_nadsec_orgs": [
        "KPN B.V."
      ]
    },
    {
      "created": "2026-05-10T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.174.95.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:05:10.000Z",
      "valid_until": "2026-06-11T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T18:32:47.604Z",
      "x_nadsec_last_seen": "2026-05-12T11:07:40.848Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--340d1954-3ec3-4a00-8abf-cfaf6e0e7473",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.206.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:05:10.000Z",
      "valid_until": "2026-06-11T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T19:51:55.573Z",
      "x_nadsec_last_seen": "2026-05-10T19:51:56.264Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dcb7cd61-cbf6-40fe-9783-681b0068a0b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:05:10.000Z",
      "valid_until": "2026-06-11T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T19:54:35.960Z",
      "x_nadsec_last_seen": "2026-05-10T19:54:35.960Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5c66b249-56e1-424d-9a8a-a54d127c3641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:05:10.000Z",
      "valid_until": "2026-06-11T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T19:39:58.954Z",
      "x_nadsec_last_seen": "2026-05-10T19:39:58.954Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5426399c-6e36-4acf-a678-7b56cef821e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:05:10.000Z",
      "valid_until": "2026-06-11T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T19:29:52.840Z",
      "x_nadsec_last_seen": "2026-05-10T19:29:52.840Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--9b8ba18f-9a5b-4513-9cad-f7bcdb56aa95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.95.192.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:05:10.000Z",
      "valid_until": "2026-06-11T20:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-10T19:36:50.419Z",
      "x_nadsec_last_seen": "2026-05-18T18:09:28.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-10T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=17816; asn_org=China Unicom IP network China169 Guangdong province; user(top)=**; pass(top)=8****8",
      "id": "indicator--ec6b0ca4-b98d-4192-962b-825947510c0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.91.117.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:05:10.000Z",
      "valid_until": "2026-06-11T21:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-10T20:45:10.385Z",
      "x_nadsec_last_seen": "2026-05-10T20:45:18.382Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17816"
      ],
      "x_nadsec_orgs": [
        "China Unicom IP network China169 Guangdong province"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "8****8"
      ]
    },
    {
      "created": "2026-05-10T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--36148765-701b-42a6-b356-72529ef7b16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:05:10.000Z",
      "valid_until": "2026-06-11T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T20:43:34.085Z",
      "x_nadsec_last_seen": "2026-05-10T20:43:34.085Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--8e1d0958-7c60-42a5-b4b4-1b8af0fea70a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.165.55.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:05:10.000Z",
      "valid_until": "2026-06-11T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T20:49:14.287Z",
      "x_nadsec_last_seen": "2026-05-10T20:51:20.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-10T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5bbed8e4-9a9c-47e4-9ae5-2176cf97abd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.55.50.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:05:10.000Z",
      "valid_until": "2026-06-11T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T20:07:03.294Z",
      "x_nadsec_last_seen": "2026-05-10T20:07:04.059Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-10T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e1a9aa04-c994-49d8-a868-9f655ab3547f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.12.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:05:10.000Z",
      "valid_until": "2026-06-11T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T20:28:10.969Z",
      "x_nadsec_last_seen": "2026-05-10T20:28:34.749Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-10T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9999bdb7-dd0c-4413-86b8-57baf41fa1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:05:10.000Z",
      "valid_until": "2026-06-11T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T21:37:14.459Z",
      "x_nadsec_last_seen": "2026-05-10T21:37:14.459Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=SC; asn=8796; asn_org=FASTNET DATA INC",
      "id": "indicator--5f1d8341-c544-4122-b3d2-0b2245a76c1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.201.92.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:05:10.000Z",
      "valid_until": "2026-06-11T22:05:08.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-10T21:58:49.976Z",
      "x_nadsec_last_seen": "2026-05-10T22:00:49.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "8796"
      ],
      "x_nadsec_orgs": [
        "FASTNET DATA INC"
      ]
    },
    {
      "created": "2026-05-10T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d9045946-83ad-4432-acc8-64fedeb4da8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:05:10.000Z",
      "valid_until": "2026-06-11T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T22:01:28.377Z",
      "x_nadsec_last_seen": "2026-05-10T22:01:28.377Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--935837dc-8d07-487e-b21b-fc397251296d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T22:05:10.000Z",
      "valid_until": "2026-06-11T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T21:38:27.568Z",
      "x_nadsec_last_seen": "2026-05-10T21:38:27.568Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-10T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--974abeba-eed5-4b08-aacd-2eedc4267cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.108.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:05:10.000Z",
      "valid_until": "2026-06-11T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T22:09:34.482Z",
      "x_nadsec_last_seen": "2026-05-10T22:09:45.805Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cb6a6884-db5d-46df-8014-967cc63d4340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.130.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:05:10.000Z",
      "valid_until": "2026-06-11T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T22:09:47.236Z",
      "x_nadsec_last_seen": "2026-05-10T22:09:47.236Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--c8c1dec5-8c74-4025-9ef3-6e7b07608743",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.253.44.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:05:10.000Z",
      "valid_until": "2026-06-11T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T22:44:57.216Z",
      "x_nadsec_last_seen": "2026-05-10T22:47:02.567Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-05-10T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mqttd; ports=1883; cc=FR; asn=211590; asn_org=Bucklog SARL",
      "id": "indicator--db7c5986-4bb8-473a-aea4-b08ff2cae6bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.177.72.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:05:10.000Z",
      "valid_until": "2026-06-11T23:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T22:15:47.152Z",
      "x_nadsec_last_seen": "2026-05-10T22:15:48.367Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "211590"
      ],
      "x_nadsec_orgs": [
        "Bucklog SARL"
      ]
    },
    {
      "created": "2026-05-10T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1c0afb5e-6b4b-4c39-ba10-7b94c4e3407b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:05:10.000Z",
      "valid_until": "2026-06-11T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T23:02:52.683Z",
      "x_nadsec_last_seen": "2026-05-10T23:02:52.683Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-10T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b353e67f-e70d-4215-9f1f-cae539da8719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.65.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:05:10.000Z",
      "valid_until": "2026-06-11T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T22:09:46.855Z",
      "x_nadsec_last_seen": "2026-05-10T22:09:46.855Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-10T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12714; asn_org=PJSC MegaFon",
      "id": "indicator--abcd5e78-f12d-4fa8-afb6-177ccc849a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-10T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.111.12.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:05:10.000Z",
      "valid_until": "2026-06-11T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T22:47:43.063Z",
      "x_nadsec_last_seen": "2026-05-10T22:49:49.590Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12714"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5497e11f-d169-4b99-be93-b6022ce6b8f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.92.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T23:53:17.346Z",
      "x_nadsec_last_seen": "2026-05-10T23:53:22.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--fb55a3bd-71df-4208-ad56-e0ff3f6fd82d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.172.101.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T23:41:13.528Z",
      "x_nadsec_last_seen": "2026-05-10T23:41:14.014Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e6d3650c-049d-415d-b439-6dd04c9f5bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T23:45:02.734Z",
      "x_nadsec_last_seen": "2026-05-28T00:32:21.028Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--955117d7-9c5a-4c6d-880b-7ddd273dee75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.202.41.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-10T23:59:44.130Z",
      "x_nadsec_last_seen": "2026-05-11T00:01:48.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DO; asn=263689; asn_org=Telecable Central, S.A.",
      "id": "indicator--e035bcf6-32ed-4330-9486-5e1965993f62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.103.183.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T23:56:20.474Z",
      "x_nadsec_last_seen": "2026-05-19T08:00:23.864Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "263689"
      ],
      "x_nadsec_orgs": [
        "Telecable Central, S.A."
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2557695b-25e4-48db-803e-b15eae04d432",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.51.234.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T23:33:08.518Z",
      "x_nadsec_last_seen": "2026-05-10T23:33:09.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--cec0b3ff-2a27-4de1-b072-d7637b407d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.86.173.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-11T00:01:27.134Z",
      "x_nadsec_last_seen": "2026-05-25T03:03:34.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=TW; asn=208137; asn_org=Feo Prest SRL; user(top)=r**t",
      "id": "indicator--1fd0e459-7ff4-45bb-bb06-2ceacc9544f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T23:38:19.942Z",
      "x_nadsec_last_seen": "2026-05-17T08:32:54.737Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=26154; asn_org=VOIP ME",
      "id": "indicator--706e24ef-00c3-41dc-8667-64aa42b7b307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.76.73.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-10T23:32:11.788Z",
      "x_nadsec_last_seen": "2026-05-25T07:11:43.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "26154"
      ],
      "x_nadsec_orgs": [
        "VOIP ME"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--63ba1563-0192-4ad2-bf58-775e51faaed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.200.148.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-10T23:18:37.490Z",
      "x_nadsec_last_seen": "2026-05-29T04:06:51.050Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--49563307-af17-47b0-bfd5-133b2efce82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T23:45:36.166Z",
      "x_nadsec_last_seen": "2026-05-10T23:47:02.851Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--73a3eab8-030e-47ff-85c5-28f46a1d98e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-10T23:45:54.471Z",
      "x_nadsec_last_seen": "2026-05-26T10:04:56.751Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--fbb3ef47-17c5-4194-9096-fd06cedd9516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T23:46:20.584Z",
      "x_nadsec_last_seen": "2026-05-10T23:46:20.584Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--6d34ba88-cd60-4e7f-ad73-5b58d83627da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T23:45:42.695Z",
      "x_nadsec_last_seen": "2026-05-26T09:01:56.938Z",
      "x_nadsec_ports": [
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=DE; asn=206092; asn_org=F.n.s. Holdings Limited; user(top)=r**t",
      "id": "indicator--e8f74d4b-3a37-4d39-ac60-f2ea6096a958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.86.202.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T23:40:02.440Z",
      "x_nadsec_last_seen": "2026-05-10T23:40:02.440Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "206092"
      ],
      "x_nadsec_orgs": [
        "F.n.s. Holdings Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c878ed6a-9ce5-442d-a7ac-75a73fd91dde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T23:56:54.663Z",
      "x_nadsec_last_seen": "2026-05-10T23:57:04.841Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--7943bac2-06d5-418d-a7aa-1802e835f391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T00:03:31.259Z",
      "x_nadsec_last_seen": "2026-05-11T00:03:31.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mirrorc; ports=33781; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--e8b4d565-5387-45f7-ba0e-ca2901cf54ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-10T23:44:37.269Z",
      "x_nadsec_last_seen": "2026-05-12T03:32:43.181Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "135",
        "33781",
        "37297"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--060ae48a-18c9-484b-b6ab-86db4e1693a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T23:41:10.647Z",
      "x_nadsec_last_seen": "2026-05-10T23:41:10.647Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--75fe8401-1861-47ab-acda-c0b5b98581f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T23:41:21.375Z",
      "x_nadsec_last_seen": "2026-05-10T23:41:21.375Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--35954e15-acd4-47c0-a8fd-2ec86b1193e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-10T23:12:59.550Z",
      "x_nadsec_last_seen": "2026-05-10T23:12:59.550Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-11T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--294109b5-ea90-40bc-825a-61f0f43fc3ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:05:11.000Z",
      "valid_until": "2026-06-12T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T23:13:09.801Z",
      "x_nadsec_last_seen": "2026-05-25T18:08:10.806Z",
      "x_nadsec_ports": [
        "42",
        "27017",
        "40603"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=JP; asn=2516; asn_org=KDDI CORPORATION",
      "id": "indicator--b20dce13-c096-4841-b835-b49cf8e5d27c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.173.86.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T01:02:17.458Z",
      "x_nadsec_last_seen": "2026-05-11T01:08:34.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2516"
      ],
      "x_nadsec_orgs": [
        "KDDI CORPORATION"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T00:38:00.630Z",
      "x_nadsec_last_seen": "2026-05-11T00:38:00.630Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--7bab686b-8ece-41a2-88a7-9fc1a5296ca9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.107.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T00:09:33.002Z",
      "x_nadsec_last_seen": "2026-05-11T00:11:39.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--9b0dcbea-888f-48a0-b8ae-6f30954b8879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T00:20:10.355Z",
      "x_nadsec_last_seen": "2026-05-11T00:22:17.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3038; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--fd187672-3c42-4338-8220-e9f044773474",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.245.135.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 3038,
      "x_nadsec_first_seen": "2026-05-11T00:26:37.581Z",
      "x_nadsec_last_seen": "2026-05-11T01:03:23.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=AR; asn=28015; asn_org=MERCO COMUNICACIONES",
      "id": "indicator--37253c70-4cf6-4f42-8bc3-47c56cabc993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.219.168.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-05-11T00:11:29.300Z",
      "x_nadsec_last_seen": "2026-05-11T00:15:24.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28015"
      ],
      "x_nadsec_orgs": [
        "MERCO COMUNICACIONES"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2a513517-2876-4bf7-af30-315c7d6c7ab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.78.100.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T00:55:34.727Z",
      "x_nadsec_last_seen": "2026-05-11T01:02:01.814Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--91436eca-c96e-4bb2-b447-4f0ab8da8a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T00:46:23.318Z",
      "x_nadsec_last_seen": "2026-05-11T00:46:23.318Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:05:10.000Z",
      "valid_until": "2026-06-12T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T00:20:40.715Z",
      "x_nadsec_last_seen": "2026-05-11T00:20:41.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-11T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=131111; asn_org=PT Mora Telematika Indonesia",
      "id": "indicator--a17c2d69-2c03-44d0-968b-ff1e54d1a44f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.159.198.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:05:10.000Z",
      "valid_until": "2026-06-12T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T01:20:12.337Z",
      "x_nadsec_last_seen": "2026-05-11T01:20:16.561Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131111"
      ],
      "x_nadsec_orgs": [
        "PT Mora Telematika Indonesia"
      ]
    },
    {
      "created": "2026-05-11T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--4b801a0e-f39f-4165-9780-9faf50f25d81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.4.242.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:05:10.000Z",
      "valid_until": "2026-06-12T02:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-11T01:33:23.069Z",
      "x_nadsec_last_seen": "2026-05-26T00:26:50.434Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-11T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--a4cb8b01-0110-4d04-ad92-0bfcb1f708f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.179.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:05:10.000Z",
      "valid_until": "2026-06-12T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-11T01:28:48.501Z",
      "x_nadsec_last_seen": "2026-05-26T00:24:45.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-11T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--3558102d-9670-4db1-bd53-7cc57c2eb3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.71.67.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:05:10.000Z",
      "valid_until": "2026-06-12T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T01:35:07.540Z",
      "x_nadsec_last_seen": "2026-05-11T01:37:14.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-11T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:05:10.000Z",
      "valid_until": "2026-06-12T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T01:53:43.618Z",
      "x_nadsec_last_seen": "2026-05-11T01:53:43.618Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=3326; asn_org=Private Joint Stock Company datagroup",
      "id": "indicator--51cd478d-ac92-4a2e-a621-b6d5df4dba7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.164.170.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:05:10.000Z",
      "valid_until": "2026-06-12T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T01:25:53.136Z",
      "x_nadsec_last_seen": "2026-05-11T01:28:00.562Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3326"
      ],
      "x_nadsec_orgs": [
        "Private Joint Stock Company datagroup"
      ]
    },
    {
      "created": "2026-05-11T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mqttd; ports=1883; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--782c616c-4765-400d-b0e2-0a26972bbfe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.92.241.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:05:10.000Z",
      "valid_until": "2026-06-12T02:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-11T01:13:22.990Z",
      "x_nadsec_last_seen": "2026-05-16T13:16:40.046Z",
      "x_nadsec_ports": [
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--9cd0daac-93d6-47a3-8dce-4e5d29f63059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.52.74.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T03:04:30.525Z",
      "x_nadsec_last_seen": "2026-05-11T03:11:32.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--f489bb7a-0725-41ad-a9f5-8d59f79b4acd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.59.179.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T02:55:31.774Z",
      "x_nadsec_last_seen": "2026-05-11T03:31:56.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--aa0ef9da-94f0-429e-af4b-ae9c8357bde9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.26.253.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-05-11T02:42:04.478Z",
      "x_nadsec_last_seen": "2026-05-11T02:45:33.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9e8f170d-3ffd-4685-8171-3926af2dd13d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.181.170.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T02:28:07.583Z",
      "x_nadsec_last_seen": "2026-05-11T02:30:12.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--61b4e761-4e6e-4be4-b170-4f5133e7eb81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.126.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T02:26:34.446Z",
      "x_nadsec_last_seen": "2026-05-11T02:26:39.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--60895f41-813a-4cc9-a2e7-df34a2ec78e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.155.137.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T02:37:16.559Z",
      "x_nadsec_last_seen": "2026-05-11T02:39:22.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--3f9fd022-c51c-4f81-ad86-ac1e4c704228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T02:45:55.120Z",
      "x_nadsec_last_seen": "2026-05-11T02:45:55.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=44020; asn_org=Modern Solutions LTD",
      "id": "indicator--bde6a336-045b-4b99-820a-43161921cd23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.94.147.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-11T02:34:43.963Z",
      "x_nadsec_last_seen": "2026-05-11T13:29:39.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44020"
      ],
      "x_nadsec_orgs": [
        "Modern Solutions LTD"
      ]
    },
    {
      "created": "2026-05-11T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--4a947409-1c9d-46ea-97ac-e1be54c516ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.9.181.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:05:10.000Z",
      "valid_until": "2026-06-12T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T02:25:37.547Z",
      "x_nadsec_last_seen": "2026-05-11T02:25:37.547Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--f8c2e56f-3937-4e58-b404-06d22107700f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.69.177.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:05:10.000Z",
      "valid_until": "2026-06-12T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T03:21:54.841Z",
      "x_nadsec_last_seen": "2026-05-11T03:23:59.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-11T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--7ea0394e-509c-4671-b33b-f4d469e3ab19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.78.31.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:05:10.000Z",
      "valid_until": "2026-06-12T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T03:22:43.239Z",
      "x_nadsec_last_seen": "2026-05-11T03:22:43.239Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-11T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:05:10.000Z",
      "valid_until": "2026-06-12T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T03:41:59.821Z",
      "x_nadsec_last_seen": "2026-05-11T03:42:01.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d5fc552e-9241-41ec-9478-35ed8731106e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.77.24.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:05:10.000Z",
      "valid_until": "2026-06-12T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T04:01:03.139Z",
      "x_nadsec_last_seen": "2026-05-11T04:03:07.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--55b53ac4-7c92-437c-8b05-644d95fe3d07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.173.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T04:28:07.899Z",
      "x_nadsec_last_seen": "2026-05-11T04:30:13.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--18515589-f12d-4caa-875f-88abd597a4b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.235.243.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-11T04:57:47.976Z",
      "x_nadsec_last_seen": "2026-05-11T05:56:34.699Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PH; asn=47154; asn_org=Husam A. H. Hijazi",
      "id": "indicator--98de1efd-2c73-4ede-a78a-a975358600fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.110.223.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 54,
      "x_nadsec_first_seen": "2026-05-11T04:26:01.476Z",
      "x_nadsec_last_seen": "2026-05-30T23:01:28.778Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "47154"
      ],
      "x_nadsec_orgs": [
        "Husam A. H. Hijazi"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--046484c5-ab97-49a7-8708-d0dfadd792cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T04:32:01.128Z",
      "x_nadsec_last_seen": "2026-05-11T04:32:01.128Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PL; asn=210895; asn_org=Podaon SIA",
      "id": "indicator--1e221312-6913-4cf4-8888-1ab4a76210cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.162.155.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 100,
      "x_nadsec_first_seen": "2026-05-11T04:18:18.070Z",
      "x_nadsec_last_seen": "2026-05-14T10:57:46.235Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "210895"
      ],
      "x_nadsec_orgs": [
        "Podaon SIA"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--00b7b6ef-ff65-4c3b-a869-360c5b1548b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.59.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T04:25:03.850Z",
      "x_nadsec_last_seen": "2026-05-11T04:25:03.850Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--16608d46-f857-48cf-b3c4-a4fc43c7e3ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.240.22.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T04:25:16.516Z",
      "x_nadsec_last_seen": "2026-05-11T04:25:49.011Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--1f1e2602-22db-4ca3-befa-2ecb63ab18d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T04:40:08.821Z",
      "x_nadsec_last_seen": "2026-05-20T13:04:36.846Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fc280feb-f7ac-4669-b400-b58b1b5dc32a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:05:10.000Z",
      "valid_until": "2026-06-12T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T04:37:41.731Z",
      "x_nadsec_last_seen": "2026-05-25T19:32:58.842Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=17465; asn_org=Cable ISP in India",
      "id": "indicator--5d8b030f-2b4a-4d9f-a12c-d8a0731e34ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.92.76.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T05:18:29.018Z",
      "x_nadsec_last_seen": "2026-05-11T05:18:29.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17465"
      ],
      "x_nadsec_orgs": [
        "Cable ISP in India"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--74f96d24-4498-4359-afb2-ccef658d4e4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.4.203.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T05:22:13.472Z",
      "x_nadsec_last_seen": "2026-05-11T05:24:18.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3148; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--51b4885f-8dc1-4e12-bf79-c9e8dfd77aa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.255.250.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-05-11T05:10:25.213Z",
      "x_nadsec_last_seen": "2026-05-11T05:49:28.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--11c49171-bc8e-4233-932c-3adee3dc4a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.233.96.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T05:10:04.366Z",
      "x_nadsec_last_seen": "2026-05-11T05:10:14.542Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0a41d434-f23a-4046-a897-0f7ed805d9f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T05:18:28.493Z",
      "x_nadsec_last_seen": "2026-05-11T05:18:28.493Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--44f7a70b-ef15-4d19-a869-d590855860b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.52.115.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T06:00:24.436Z",
      "x_nadsec_last_seen": "2026-05-11T06:02:30.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--89279041-151d-48af-a5ef-20a445f0742c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.122.11.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-11T05:36:16.003Z",
      "x_nadsec_last_seen": "2026-05-11T05:50:46.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=18106; asn_org=Viewqwest Pte Ltd",
      "id": "indicator--8da62290-674b-40c7-997e-9f8a211608e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.55.84.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T05:56:11.219Z",
      "x_nadsec_last_seen": "2026-05-11T05:56:11.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "18106"
      ],
      "x_nadsec_orgs": [
        "Viewqwest Pte Ltd"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SG; asn=4817; asn_org=Simba Telecom Pte Ltd",
      "id": "indicator--055b4e2b-7324-4fd1-9e2e-2cec24e293b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.10.0.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T05:30:15.896Z",
      "x_nadsec_last_seen": "2026-05-11T05:35:29.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "4817"
      ],
      "x_nadsec_orgs": [
        "Simba Telecom Pte Ltd"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=4817; asn_org=Simba Telecom Pte Ltd",
      "id": "indicator--28093fa5-b30a-4a2f-98a4-b081c7fd8dc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.10.2.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T05:37:33.831Z",
      "x_nadsec_last_seen": "2026-05-11T05:37:34.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "4817"
      ],
      "x_nadsec_orgs": [
        "Simba Telecom Pte Ltd"
      ]
    },
    {
      "created": "2026-05-11T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--c9d6cbb8-15da-4dfb-b523-774a74dde9a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T06:05:10.000Z",
      "valid_until": "2026-06-12T06:05:09.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-05-11T05:16:24.146Z",
      "x_nadsec_last_seen": "2026-05-31T15:38:55.360Z",
      "x_nadsec_ports": [
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=136969; asn_org=KK Networks Pvt Ltd.",
      "id": "indicator--81615859-05b4-4e73-92e7-4d67f241bc12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.178.121.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T06:39:55.344Z",
      "x_nadsec_last_seen": "2026-05-11T06:42:00.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "136969"
      ],
      "x_nadsec_orgs": [
        "KK Networks Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--8ef23e84-063c-4b80-ad72-abf626624616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.58.248.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T06:11:06.138Z",
      "x_nadsec_last_seen": "2026-05-11T06:13:11.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ad3c6495-a4a3-4d03-b87e-3644cb705c48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T06:29:15.412Z",
      "x_nadsec_last_seen": "2026-05-28T14:54:47.495Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--75fd664e-d295-4495-8770-034eb8885c9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.67.228.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T06:11:17.300Z",
      "x_nadsec_last_seen": "2026-05-11T06:11:23.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8610047e-fb6d-4b81-9a69-c000ad285f1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T06:12:23.470Z",
      "x_nadsec_last_seen": "2026-05-11T06:12:23.470Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b1095af2-b1d8-4e87-96e7-6173e7b6734c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T06:35:47.714Z",
      "x_nadsec_last_seen": "2026-05-11T06:35:47.714Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50187; asn_org=BaikalWestCom",
      "id": "indicator--3dc0c127-e809-4604-81dd-dd12a6d46b9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.183.147.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T06:19:49.531Z",
      "x_nadsec_last_seen": "2026-05-11T06:21:56.736Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50187"
      ],
      "x_nadsec_orgs": [
        "BaikalWestCom"
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7697e62e-a969-4209-8c8b-330ece866aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T06:56:39.327Z",
      "x_nadsec_last_seen": "2026-05-31T00:10:06.675Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=21479; asn_org=Rostelecom",
      "id": "indicator--378310ac-cc42-4994-b75e-74557937c06e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.221.222.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T06:34:08.498Z",
      "x_nadsec_last_seen": "2026-05-11T06:43:02.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21479"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--cd86f8f4-d184-4650-b4e1-af16d41b7a06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.185.85.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T06:11:39.748Z",
      "x_nadsec_last_seen": "2026-05-11T06:11:47.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "58224"
      ],
      "x_nadsec_orgs": [
        "Iran Telecommunication Company PJS"
      ]
    },
    {
      "created": "2026-05-11T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--db8f7231-4efb-48d4-9d58-8103221e04ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.109.15.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:05:10.000Z",
      "valid_until": "2026-06-12T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T06:27:25.879Z",
      "x_nadsec_last_seen": "2026-05-11T06:35:22.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-11T08:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--436bc86b-8c28-4939-8972-18359f35b2e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.25.232.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:05:31.000Z",
      "valid_until": "2026-06-12T08:05:03.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-11T07:26:58.960Z",
      "x_nadsec_last_seen": "2026-05-11T08:41:12.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-11T08:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:05:31.000Z",
      "valid_until": "2026-06-12T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T07:13:50.246Z",
      "x_nadsec_last_seen": "2026-05-18T21:21:49.340Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-11T08:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--4a25b819-7360-42fb-9a7c-10a1f404602f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.128.160.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:05:31.000Z",
      "valid_until": "2026-06-12T08:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T07:51:18.060Z",
      "x_nadsec_last_seen": "2026-05-11T07:51:18.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-05-11T08:05:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--73f66644-728d-4952-839a-d6d8ac2ea055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T08:05:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.49.231.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T08:05:31.000Z",
      "valid_until": "2026-06-12T08:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-11T07:56:23.534Z",
      "x_nadsec_last_seen": "2026-05-11T08:34:32.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--16db9f43-bcb7-47d8-8f00-3b82b8472255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.132.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-11T08:33:14.599Z",
      "x_nadsec_last_seen": "2026-05-11T08:33:43.136Z",
      "x_nadsec_ports": [
        "27017",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.182.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T08:33:18.357Z",
      "x_nadsec_last_seen": "2026-05-11T08:33:18.514Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T08:21:22.918Z",
      "x_nadsec_last_seen": "2026-05-24T12:32:27.345Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47165; asn_org=Omskie kabelnye seti Ltd.",
      "id": "indicator--ebe63826-f361-4799-8364-8b34b0a5bb3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.13.178.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T08:37:33.663Z",
      "x_nadsec_last_seen": "2026-05-11T08:39:40.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47165"
      ],
      "x_nadsec_orgs": [
        "Omskie kabelnye seti Ltd."
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf060765-b95d-4d59-9d47-8104c6be6cdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.33.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T08:45:17.748Z",
      "x_nadsec_last_seen": "2026-05-11T08:45:17.748Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=268902; asn_org=NETMASTER PORTEIRINHA ME",
      "id": "indicator--e6cecadd-9e44-4b5b-8122-d389fff3a51c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.175.174.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T08:48:19.051Z",
      "x_nadsec_last_seen": "2026-05-11T08:50:26.122Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268902"
      ],
      "x_nadsec_orgs": [
        "NETMASTER PORTEIRINHA ME"
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--3034fdc3-8320-4c8b-84f7-6c2860724bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.156.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T08:15:33.454Z",
      "x_nadsec_last_seen": "2026-05-11T08:15:33.454Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-11T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--487c82b8-5e7e-468d-9bbe-5df4d7fc2587",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.79.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:05:11.000Z",
      "valid_until": "2026-06-12T09:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T08:50:28.139Z",
      "x_nadsec_last_seen": "2026-05-11T08:50:28.139Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=137354; asn_org=PT. Data Sinergitama Jaya",
      "id": "indicator--c60b737a-5c34-4f28-8c6d-1d2f4e136e90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.114.244.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:05:10.000Z",
      "valid_until": "2026-06-12T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T10:37:34.798Z",
      "x_nadsec_last_seen": "2026-05-19T07:35:51.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "137354"
      ],
      "x_nadsec_orgs": [
        "PT. Data Sinergitama Jaya"
      ]
    },
    {
      "created": "2026-05-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6371437a-b1fa-4b66-b2ff-eb158b46c715",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:05:10.000Z",
      "valid_until": "2026-06-12T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T10:21:26.287Z",
      "x_nadsec_last_seen": "2026-05-11T10:21:26.287Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a9b15d9a-5628-4463-8604-5754a33138d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.59.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:05:10.000Z",
      "valid_until": "2026-06-12T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T10:10:34.110Z",
      "x_nadsec_last_seen": "2026-05-11T10:11:42.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-11T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=27717; asn_org=Corporacion Digitel C.A.",
      "id": "indicator--9a1da3b5-534b-4d43-9037-3a2c5128253c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.121.239.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:05:10.000Z",
      "valid_until": "2026-06-12T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T10:53:03.523Z",
      "x_nadsec_last_seen": "2026-05-11T10:53:03.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "27717"
      ],
      "x_nadsec_orgs": [
        "Corporacion Digitel C.A."
      ]
    },
    {
      "created": "2026-05-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=139280; asn_org=WETUBE NETWORK",
      "id": "indicator--61890b08-58e5-4335-ba08-a92658e275fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.140.177.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:05:11.000Z",
      "valid_until": "2026-06-12T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T12:03:22.818Z",
      "x_nadsec_last_seen": "2026-05-11T12:05:27.709Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "139280"
      ],
      "x_nadsec_orgs": [
        "WETUBE NETWORK"
      ]
    },
    {
      "created": "2026-05-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c9757b0c-c0a3-4331-be96-d5bc24cde493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:05:11.000Z",
      "valid_until": "2026-06-12T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T11:32:28.602Z",
      "x_nadsec_last_seen": "2026-05-11T11:32:28.602Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--f7f3ef71-fc58-450e-abbd-4bd10a7161b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.176.170.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:05:11.000Z",
      "valid_until": "2026-06-12T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T11:11:51.191Z",
      "x_nadsec_last_seen": "2026-05-11T11:13:58.248Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--7a7d6936-27f4-4c73-8ad3-83201c9a1668",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.82.184.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:05:11.000Z",
      "valid_until": "2026-06-12T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T11:25:58.759Z",
      "x_nadsec_last_seen": "2026-05-11T11:28:03.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=327693; asn_org=ECHO-SP",
      "id": "indicator--020acf2f-55a1-41b8-91b0-5790b0ca3be3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.76.230.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:05:11.000Z",
      "valid_until": "2026-06-12T12:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-11T11:52:28.017Z",
      "x_nadsec_last_seen": "2026-05-14T06:04:37.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327693"
      ],
      "x_nadsec_orgs": [
        "ECHO-SP"
      ]
    },
    {
      "created": "2026-05-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--61b0f9d0-d321-4c6c-ae8e-ac6fffe9c2f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.205.178.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:05:11.000Z",
      "valid_until": "2026-06-12T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T12:02:59.993Z",
      "x_nadsec_last_seen": "2026-05-11T12:03:00.188Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-11T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--629540f4-a8f7-486d-b556-db7a47dac753",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.106.182.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:05:11.000Z",
      "valid_until": "2026-06-12T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T11:18:28.444Z",
      "x_nadsec_last_seen": "2026-05-11T11:25:42.213Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--41c02011-d35b-4983-8a81-30157648a20a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.254.93.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-11T12:38:35.473Z",
      "x_nadsec_last_seen": "2026-05-25T07:25:35.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--ae542a89-1fe4-4792-93ab-fa1be45b3a9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.173.26.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T12:15:08.825Z",
      "x_nadsec_last_seen": "2026-05-11T12:22:11.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1976c0df-3a1b-441d-b9af-96a2b53aa358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T12:27:16.976Z",
      "x_nadsec_last_seen": "2026-05-22T12:37:06.663Z",
      "x_nadsec_ports": [
        "42",
        "3306",
        "44135"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--bddd9184-4f86-4692-b720-7260e61936e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-11T12:12:45.270Z",
      "x_nadsec_last_seen": "2026-05-11T12:13:35.273Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T12:54:05.806Z",
      "x_nadsec_last_seen": "2026-05-28T08:11:45.432Z",
      "x_nadsec_ports": [
        "81",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--31950fdd-47c7-4e71-899e-a7ac8c0f035d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T12:37:02.132Z",
      "x_nadsec_last_seen": "2026-05-27T10:41:10.629Z",
      "x_nadsec_ports": [
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T12:52:36.080Z",
      "x_nadsec_last_seen": "2026-05-11T18:19:16.610Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-11T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:05:10.000Z",
      "valid_until": "2026-06-12T13:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T12:59:04.316Z",
      "x_nadsec_last_seen": "2026-05-29T08:17:55.879Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=epmapper; ports=135; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d9b5c74f-09c6-4b4e-b6e5-672c57f8d71b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.143.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:05:10.000Z",
      "valid_until": "2026-06-12T14:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T13:10:54.176Z",
      "x_nadsec_last_seen": "2026-05-11T13:14:06.129Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "38837"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--41c39de7-6682-4f74-9dbf-a4b12830b308",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.70.52.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:05:10.000Z",
      "valid_until": "2026-06-12T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T13:37:51.034Z",
      "x_nadsec_last_seen": "2026-05-11T13:40:01.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-05-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263008; asn_org=RIO CABLE CORPORATE LTDA - ME",
      "id": "indicator--4b49196e-7b4e-4c74-bc4e-52448b804f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.226.214.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:05:10.000Z",
      "valid_until": "2026-06-12T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T13:15:30.500Z",
      "x_nadsec_last_seen": "2026-05-11T13:15:37.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263008"
      ],
      "x_nadsec_orgs": [
        "RIO CABLE CORPORATE LTDA - ME"
      ]
    },
    {
      "created": "2026-05-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--560064df-2cfb-40e2-8af8-bc86df615393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.251.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:05:10.000Z",
      "valid_until": "2026-06-12T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T13:21:56.147Z",
      "x_nadsec_last_seen": "2026-05-23T19:00:21.198Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--6cdf000b-18c8-435a-81c3-c7f983582f48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.86.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:05:10.000Z",
      "valid_until": "2026-06-12T14:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-11T13:21:55.535Z",
      "x_nadsec_last_seen": "2026-05-31T13:16:57.472Z",
      "x_nadsec_ports": [
        "3306",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-11T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--41497bfb-f484-42b8-8133-cca0a21ad78d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.133.68.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:05:10.000Z",
      "valid_until": "2026-06-12T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T14:00:29.367Z",
      "x_nadsec_last_seen": "2026-05-11T14:11:15.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24173; asn_org=Netnam Company",
      "id": "indicator--ae97c78e-3b97-43fd-977a-bc209d363a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.96.104.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T14:22:32.384Z",
      "x_nadsec_last_seen": "2026-05-11T14:24:38.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24173"
      ],
      "x_nadsec_orgs": [
        "Netnam Company"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45884; asn_org=RVR Infrastructure Limited Service provider hyderabad india",
      "id": "indicator--9065c866-b16f-4ac0-bb6e-c7d8a685e70a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.242.153.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T14:15:21.664Z",
      "x_nadsec_last_seen": "2026-05-11T14:21:50.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45884"
      ],
      "x_nadsec_orgs": [
        "RVR Infrastructure Limited Service provider hyderabad india"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c5d2674b-a105-4f58-bde8-6c64eb71853f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.248.208.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-11T14:26:46.960Z",
      "x_nadsec_last_seen": "2026-05-11T14:27:41.379Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bd2b5763-148e-41ad-bb26-d59e1494603e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.171.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T14:25:09.230Z",
      "x_nadsec_last_seen": "2026-05-11T14:25:09.230Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28669; asn_org=VERO S.A",
      "id": "indicator--cdfaa3be-9f21-4b46-aa3b-e6e690fabb23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.241.226.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T14:42:14.760Z",
      "x_nadsec_last_seen": "2026-05-11T14:43:00.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28669"
      ],
      "x_nadsec_orgs": [
        "VERO S.A"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--ee1130a5-34f7-4734-9497-e2775d4370bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.49.214.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T14:56:42.315Z",
      "x_nadsec_last_seen": "2026-05-12T00:22:21.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=266926; asn_org=EJNET LTDA - ME",
      "id": "indicator--a16780f2-ed05-4611-b0ed-85f84d3bbbd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.225.22.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T14:39:54.309Z",
      "x_nadsec_last_seen": "2026-05-11T14:39:55.997Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266926"
      ],
      "x_nadsec_orgs": [
        "EJNET LTDA - ME"
      ]
    },
    {
      "created": "2026-05-11T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--cd524bf6-4f52-428e-b863-7f7bb048a559",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.36.23.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:05:10.000Z",
      "valid_until": "2026-06-12T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T14:26:20.919Z",
      "x_nadsec_last_seen": "2026-05-11T14:39:56.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--74f54b94-3478-4dea-9b72-f155ceda1ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.204.19.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T15:20:21.502Z",
      "x_nadsec_last_seen": "2026-05-11T15:22:26.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--59e11966-28fe-42de-9a19-03b81066df88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-11T15:44:07.571Z",
      "x_nadsec_last_seen": "2026-05-11T15:44:13.325Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1433",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-11T15:35:45.042Z",
      "x_nadsec_last_seen": "2026-05-16T13:13:27.008Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--401678fe-4cd5-4337-a95b-b8fb24511817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T15:52:35.241Z",
      "x_nadsec_last_seen": "2026-05-11T15:52:35.241Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--34669909-db39-4fc8-97b4-ca02095ac164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.187.179.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T15:35:41.029Z",
      "x_nadsec_last_seen": "2026-05-11T15:35:42.962Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fdc1783e-1828-4e95-bfad-8dfb284c2e85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.237.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-11T15:23:07.850Z",
      "x_nadsec_last_seen": "2026-05-11T15:24:06.174Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=GB; asn=12390; asn_org=KCOM Group Limited",
      "id": "indicator--a50b49e3-230c-4260-bb56-8a5d6d28025c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.249.198.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T16:01:57.241Z",
      "x_nadsec_last_seen": "2026-05-11T16:04:03.275Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "12390"
      ],
      "x_nadsec_orgs": [
        "KCOM Group Limited"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--8966c197-4acb-4380-b43c-100012678c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.33.102.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T15:22:53.121Z",
      "x_nadsec_last_seen": "2026-05-11T15:22:53.121Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--2fe8116d-7234-47ec-a46c-34181a91868e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.141.88.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-11T16:03:42.867Z",
      "x_nadsec_last_seen": "2026-05-11T16:34:23.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d76abae8-cba0-47b2-beb8-28fa18183250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T15:55:08.144Z",
      "x_nadsec_last_seen": "2026-05-20T01:10:24.949Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "36677"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-11T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--e376c9b8-9a13-4bf9-83c4-2bc1851491aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:05:04.000Z",
      "valid_until": "2026-06-12T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T15:55:16.804Z",
      "x_nadsec_last_seen": "2026-05-11T15:55:16.804Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-11T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; user(top)=**",
      "id": "indicator--544a8398-86cf-44ac-a669-f9cb956425d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.213.114.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:05:04.000Z",
      "valid_until": "2026-06-12T17:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T16:49:56.844Z",
      "x_nadsec_last_seen": "2026-05-18T03:05:08.470Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f6806d7d-54f0-45af-ae82-3e390c0816ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.247.58.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:05:04.000Z",
      "valid_until": "2026-06-12T17:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T16:50:44.762Z",
      "x_nadsec_last_seen": "2026-05-11T16:52:49.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-11T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--c08ba408-15f0-468a-b285-16235b87b826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.0.22.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:05:04.000Z",
      "valid_until": "2026-06-12T17:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T16:58:46.499Z",
      "x_nadsec_last_seen": "2026-05-11T17:05:49.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-05-11T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0dc6c65a-01c0-40f8-8017-d4cbba3c5d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.152.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:05:04.000Z",
      "valid_until": "2026-06-12T17:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T16:37:10.667Z",
      "x_nadsec_last_seen": "2026-05-11T16:37:11.017Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--1257f291-ec60-455f-957b-2d81e60e99d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.53.252.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:05:04.000Z",
      "valid_until": "2026-06-12T17:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T16:13:39.569Z",
      "x_nadsec_last_seen": "2026-05-11T16:13:40.075Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-11T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=41465; asn_org=Limited Liability Company VolgoGazTelecom",
      "id": "indicator--d13c17cf-33d3-4434-86d3-276cac1c36d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.19.193.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:05:04.000Z",
      "valid_until": "2026-06-12T17:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T16:09:35.779Z",
      "x_nadsec_last_seen": "2026-05-27T08:31:28.710Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41465"
      ],
      "x_nadsec_orgs": [
        "Limited Liability Company VolgoGazTelecom"
      ]
    },
    {
      "created": "2026-05-11T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fbdeae1a-730a-472b-b89b-100c4f9627ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.60.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:05:10.000Z",
      "valid_until": "2026-06-12T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T17:27:28.145Z",
      "x_nadsec_last_seen": "2026-05-11T17:27:28.145Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--f5f62157-b3ec-4ad3-80b6-6723067c88c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.239.134.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:05:10.000Z",
      "valid_until": "2026-06-12T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T17:54:20.709Z",
      "x_nadsec_last_seen": "2026-05-11T17:56:27.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-05-11T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA; user(top)=**",
      "id": "indicator--6ec9b8a6-8aa0-40bd-898c-413bbb2ba40b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.10.108.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:05:10.000Z",
      "valid_until": "2026-06-12T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T17:48:02.220Z",
      "x_nadsec_last_seen": "2026-05-16T21:37:52.849Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5f4fbe59-5d7f-49c3-8b94-395558fb6a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.15.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:05:10.000Z",
      "valid_until": "2026-06-12T18:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-11T17:53:55.691Z",
      "x_nadsec_last_seen": "2026-05-11T17:54:24.212Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-11T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--0cfff881-bef9-4664-a519-3b64d912a617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.69.187.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:05:10.000Z",
      "valid_until": "2026-06-12T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T17:23:47.809Z",
      "x_nadsec_last_seen": "2026-05-11T17:23:47.996Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-11T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--3bb87bd1-abb3-4fd1-a8a6-54a00ca01be9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.158.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:05:10.000Z",
      "valid_until": "2026-06-12T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T17:35:22.534Z",
      "x_nadsec_last_seen": "2026-05-11T17:35:22.534Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-11T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c6665c36-b35f-47a2-b1e4-0de57e817a76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.106.112.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:05:10.000Z",
      "valid_until": "2026-06-12T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T17:54:18.622Z",
      "x_nadsec_last_seen": "2026-05-11T17:56:25.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--bde365c8-d59f-422d-b292-850ac3f066e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.56.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T18:54:22.798Z",
      "x_nadsec_last_seen": "2026-05-11T18:54:41.629Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9a19a009-eb96-402c-8c5d-8d391d1ae307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T18:14:42.736Z",
      "x_nadsec_last_seen": "2026-05-11T18:15:04.378Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--86d373df-5b4a-49df-b516-d153ad81fe70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.96.28.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T19:03:36.407Z",
      "x_nadsec_last_seen": "2026-05-11T19:03:36.407Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**; pass(top)=***",
      "id": "indicator--d250efd4-06f9-4631-8be5-9e69b9c6df1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.22.61.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T18:47:56.447Z",
      "x_nadsec_last_seen": "2026-05-11T18:47:56.447Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--dbdbecba-7f6b-4b6e-a03c-4c1961e4ea60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.186.75.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T19:01:03.986Z",
      "x_nadsec_last_seen": "2026-05-11T19:03:08.897Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2da53215-990c-4ca6-9acd-94a2ad385114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T18:34:16.650Z",
      "x_nadsec_last_seen": "2026-05-11T18:34:16.650Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T18:31:46.925Z",
      "x_nadsec_last_seen": "2026-05-28T11:37:02.616Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=207043; asn_org=Dedik Services Limited",
      "id": "indicator--c7b85c07-2572-4434-b1b2-6a595f764dc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.25.63.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:05:10.000Z",
      "valid_until": "2026-06-12T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T18:12:35.682Z",
      "x_nadsec_last_seen": "2026-05-11T18:12:35.682Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "207043"
      ],
      "x_nadsec_orgs": [
        "Dedik Services Limited"
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--03f5d6f4-8c32-4e9e-b800-377bb84000ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.43.8.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T19:51:51.648Z",
      "x_nadsec_last_seen": "2026-05-11T19:53:58.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--70ff47a9-c696-4839-9b2d-1988651f7b43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.209.107.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-11T19:43:23.526Z",
      "x_nadsec_last_seen": "2026-05-11T21:53:13.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c846e5c2-0183-4fe2-80f5-a355b167a58f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.57.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T19:21:50.867Z",
      "x_nadsec_last_seen": "2026-05-11T19:21:50.867Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7095a357-57da-4aa3-a250-63514a74d30b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.128.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T19:22:45.257Z",
      "x_nadsec_last_seen": "2026-05-11T19:22:45.257Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bb4f14ab-ac8f-47d7-ab31-eda1b813e990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T19:47:36.576Z",
      "x_nadsec_last_seen": "2026-05-31T02:59:35.563Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=48503; asn_org=Mobile Telecom-Service LLP",
      "id": "indicator--f1da2226-99dc-47a8-992e-9fc3067393fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.137.178.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T19:56:36.162Z",
      "x_nadsec_last_seen": "2026-05-11T19:56:43.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "48503"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecom-Service LLP"
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--78deb603-9828-4483-8e62-dffe3b1cc263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T19:26:16.741Z",
      "x_nadsec_last_seen": "2026-05-28T16:07:40.235Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-11T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b5aeee81-50be-45fe-ae7e-ae3e54929bd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T20:05:10.000Z",
      "valid_until": "2026-06-12T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T19:26:15.291Z",
      "x_nadsec_last_seen": "2026-05-11T19:26:15.291Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-11T21:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--484adf9d-b8ad-4dce-8793-d354390fd28d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:05:17.000Z",
      "valid_until": "2026-06-12T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T20:54:11.284Z",
      "x_nadsec_last_seen": "2026-05-28T08:40:22.042Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T21:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5d8473dd-87a1-471c-b9f1-b010099ed76f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:05:17.000Z",
      "valid_until": "2026-06-12T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T20:15:27.137Z",
      "x_nadsec_last_seen": "2026-05-28T04:08:39.167Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T21:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25531; asn_org=Rostelecom",
      "id": "indicator--5c6ebf13-fb48-4b02-90f5-126c207a577c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.17.36.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:05:17.000Z",
      "valid_until": "2026-06-12T21:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-11T20:52:11.581Z",
      "x_nadsec_last_seen": "2026-05-14T04:24:58.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25531"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-11T21:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--50b40bbc-dacf-4364-97f0-6a5d77aaffa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T21:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.120.131.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:05:17.000Z",
      "valid_until": "2026-06-12T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T20:22:26.757Z",
      "x_nadsec_last_seen": "2026-05-11T20:24:33.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--57bf2bb8-1e7a-48ae-a59b-417bcad306e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.51.248.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T21:41:13.828Z",
      "x_nadsec_last_seen": "2026-05-11T21:43:18.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--c86ee2f4-5b3d-49a5-b4eb-8c848f25425b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.75.40.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T21:12:56.217Z",
      "x_nadsec_last_seen": "2026-05-11T21:15:02.814Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d0d5a31a-4960-42e3-9acb-2f5a639cd1c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.205.23.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T21:35:34.068Z",
      "x_nadsec_last_seen": "2026-05-11T21:37:41.119Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4cf52972-5540-4b78-8819-0e10498ffd67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T21:10:37.475Z",
      "x_nadsec_last_seen": "2026-05-11T21:10:37.475Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=55821; asn_org=RADIUS TELECOMS, INC.",
      "id": "indicator--5def2fa7-741e-49f6-af24-1f6134aacc47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.141.9.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T21:24:00.052Z",
      "x_nadsec_last_seen": "2026-05-11T21:25:07.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "55821"
      ],
      "x_nadsec_orgs": [
        "RADIUS TELECOMS, INC."
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--1f2c7aa9-9d7e-45a4-9ea2-191069413b9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.195.84.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T21:10:01.655Z",
      "x_nadsec_last_seen": "2026-05-11T21:10:01.655Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--88f1618b-ae5e-42fc-abcc-28660e5a6b0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.111.178.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T21:38:36.234Z",
      "x_nadsec_last_seen": "2026-05-11T21:40:43.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T21:34:29.719Z",
      "x_nadsec_last_seen": "2026-05-31T17:30:32.310Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-11T22:01:27.360Z",
      "x_nadsec_last_seen": "2026-05-27T22:42:45.912Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-11T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=196797; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--8f9e6afb-655b-4831-b1c2-6d9a6adf8aea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.30.52.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T22:05:10.000Z",
      "valid_until": "2026-06-12T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-11T21:42:29.543Z",
      "x_nadsec_last_seen": "2026-05-11T21:50:08.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "196797"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-05-11T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=146943; asn_org=Tier 4 Cloud Services",
      "id": "indicator--581fee53-0e54-4025-a489-bbbeea5216e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.233.24.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:05:10.000Z",
      "valid_until": "2026-06-12T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T22:28:35.774Z",
      "x_nadsec_last_seen": "2026-05-29T15:45:55.568Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "146943"
      ],
      "x_nadsec_orgs": [
        "Tier 4 Cloud Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-11T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a9b0e37d-1524-4d4d-99b8-310883f2efb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.80.83.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:05:10.000Z",
      "valid_until": "2026-06-12T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-11T22:39:03.856Z",
      "x_nadsec_last_seen": "2026-05-11T22:39:03.856Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-11T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--506d9e3b-7fe7-4a33-8c2d-6e8f4af94d3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-11T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.72.98.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:05:10.000Z",
      "valid_until": "2026-06-12T23:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-11T22:48:49.317Z",
      "x_nadsec_last_seen": "2026-05-17T12:43:12.707Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-12T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8db873b1-31d7-41b8-9a2a-3d60983bd39e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.173.49.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:05:12.000Z",
      "valid_until": "2026-06-13T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T23:07:52.380Z",
      "x_nadsec_last_seen": "2026-05-11T23:09:57.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-12T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8df3b778-006d-4e8b-9214-c21ff5abaf1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:05:12.000Z",
      "valid_until": "2026-06-13T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T23:23:26.029Z",
      "x_nadsec_last_seen": "2026-05-13T18:58:51.916Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=4750; asn_org=CS LOXINFO PUBLIC COMPANY LIMITED",
      "id": "indicator--21c64823-bf35-4c7d-b756-eeddd9b8bd3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.183.226.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:05:12.000Z",
      "valid_until": "2026-06-13T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T23:26:40.743Z",
      "x_nadsec_last_seen": "2026-05-11T23:28:45.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4750"
      ],
      "x_nadsec_orgs": [
        "CS LOXINFO PUBLIC COMPANY LIMITED"
      ]
    },
    {
      "created": "2026-05-12T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=267251; asn_org=TELEFONARNET TELECOMUNICACOES",
      "id": "indicator--fb61922e-e49d-4a2c-9eb7-382b7cda7c75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.232.74.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:05:12.000Z",
      "valid_until": "2026-06-13T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T23:41:49.461Z",
      "x_nadsec_last_seen": "2026-05-11T23:42:36.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267251"
      ],
      "x_nadsec_orgs": [
        "TELEFONARNET TELECOMUNICACOES"
      ]
    },
    {
      "created": "2026-05-12T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--48f31d44-a6be-4621-ada7-e37e05fdeeb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.217.101.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:05:12.000Z",
      "valid_until": "2026-06-13T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-11T23:20:42.453Z",
      "x_nadsec_last_seen": "2026-05-11T23:20:49.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-05-12T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--c8cfab5a-0eb5-44c2-9250-6c9a0caaccdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.7.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:05:12.000Z",
      "valid_until": "2026-06-13T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-11T23:25:30.956Z",
      "x_nadsec_last_seen": "2026-05-11T23:25:54.740Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-12T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AZ; asn=8814; asn_org=Aztelekom LLC",
      "id": "indicator--198fbb68-e263-4aba-9982-41fcc994b4cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.69.58.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:05:12.000Z",
      "valid_until": "2026-06-13T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-03T18:37:31.968Z",
      "x_nadsec_last_seen": "2026-05-30T23:10:16.886Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**; pass(top)=!******x",
      "id": "indicator--717bc534-d0f7-4c08-bb7c-b7949b883755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.207.142.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:05:11.000Z",
      "valid_until": "2026-06-13T01:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-12T00:52:08.349Z",
      "x_nadsec_last_seen": "2026-05-12T00:52:19.854Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-12T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--0e20ba88-c146-45c5-a5c1-7c334ddb29bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.93.198.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:05:11.000Z",
      "valid_until": "2026-06-13T01:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T00:05:25.756Z",
      "x_nadsec_last_seen": "2026-05-12T00:07:29.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-12T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--5b3c0f10-7832-449e-8050-c3bee9222203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.22.42.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:05:11.000Z",
      "valid_until": "2026-06-13T01:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-12T00:15:40.588Z",
      "x_nadsec_last_seen": "2026-05-29T09:27:33.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-12T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=16276; asn_org=OVH SAS",
      "id": "indicator--9653c142-8f1d-4e99-83a1-dfb7ec379d81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '15.235.119.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:05:11.000Z",
      "valid_until": "2026-06-13T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T00:49:19.613Z",
      "x_nadsec_last_seen": "2026-05-12T00:49:19.613Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-12T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--03d7ddef-9baa-4bb2-a913-5d9ce89887c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.115.214.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:05:11.000Z",
      "valid_until": "2026-06-13T01:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T01:02:15.422Z",
      "x_nadsec_last_seen": "2026-05-12T01:07:15.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-12T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--e7aa016c-f901-44f6-812c-8a1c5671294a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.144.98.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:05:11.000Z",
      "valid_until": "2026-06-13T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T00:56:21.363Z",
      "x_nadsec_last_seen": "2026-05-12T00:56:21.363Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-12T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--6f8644d4-71a0-4f1a-ac6b-9971fe076fd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T01:05:11.000Z",
      "valid_until": "2026-06-13T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T00:54:15.756Z",
      "x_nadsec_last_seen": "2026-05-12T00:54:15.756Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135780; asn_org=AirFiber Networks Pvt Ltd",
      "id": "indicator--cdcea301-8cec-4a26-ac4c-ee9510e5a569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.167.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T01:16:56.924Z",
      "x_nadsec_last_seen": "2026-05-12T01:19:01.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135780"
      ],
      "x_nadsec_orgs": [
        "AirFiber Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JP; asn=18126; asn_org=Chubu Telecommunications Company, Inc.",
      "id": "indicator--4c2cfc15-f353-46bb-8699-0a4aea2253cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.38.51.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T01:23:46.091Z",
      "x_nadsec_last_seen": "2026-05-12T04:08:38.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "18126"
      ],
      "x_nadsec_orgs": [
        "Chubu Telecommunications Company, Inc."
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--18a3c21a-c249-442a-a497-e371d9968806",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T01:13:37.454Z",
      "x_nadsec_last_seen": "2026-05-13T20:15:21.899Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--bb9f3778-3840-48d4-8641-7e579b55ebb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.35.65.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T01:39:54.006Z",
      "x_nadsec_last_seen": "2026-05-12T01:47:07.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--32022e19-a268-41a3-bd5b-160175e6f179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.81.47.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T01:05:19.898Z",
      "x_nadsec_last_seen": "2026-05-12T01:05:19.898Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=4618; asn_org=Internet Thailand Company Limited",
      "id": "indicator--efd67ebd-a468-4798-bd7b-b39d4a15c611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.150.112.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T02:02:00.455Z",
      "x_nadsec_last_seen": "2026-05-12T02:04:13.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4618"
      ],
      "x_nadsec_orgs": [
        "Internet Thailand Company Limited"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d10ac882-5034-4df3-b87f-a3d19570ad39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-12T01:19:47.096Z",
      "x_nadsec_last_seen": "2026-05-16T16:38:53.934Z",
      "x_nadsec_ports": [
        "135",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9b8814d2-ce40-436e-85a6-2e9c6dacb3a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.69.59.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T01:59:44.281Z",
      "x_nadsec_last_seen": "2026-05-12T02:06:32.309Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--6e57d733-d64d-45b4-bdf8-a534f3b1e69e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-12T01:40:37.639Z",
      "x_nadsec_last_seen": "2026-05-12T01:40:48.436Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-05-12T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f1f9789b-86a1-4a2c-bb31-146c3f650182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:05:10.000Z",
      "valid_until": "2026-06-13T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T01:33:56.439Z",
      "x_nadsec_last_seen": "2026-05-31T22:06:39.709Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--165ce252-d04f-4d72-8d6e-a24e15a84f00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.158.52.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:05:10.000Z",
      "valid_until": "2026-06-13T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T02:06:44.656Z",
      "x_nadsec_last_seen": "2026-05-12T02:06:44.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-12T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--27986a15-76ed-44a1-abfe-738fe78e23ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.8.99.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:05:10.000Z",
      "valid_until": "2026-06-13T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T02:11:26.247Z",
      "x_nadsec_last_seen": "2026-05-12T02:13:34.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-12T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--da585f28-7473-4102-8035-e88fecb29aa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:05:10.000Z",
      "valid_until": "2026-06-13T03:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-12T03:02:14.622Z",
      "x_nadsec_last_seen": "2026-05-24T19:28:37.456Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=I*****@",
      "id": "indicator--fd08c435-849d-4fdb-8be4-356555fe51c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.14.60.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:05:10.000Z",
      "valid_until": "2026-06-13T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T02:59:08.733Z",
      "x_nadsec_last_seen": "2026-05-12T02:59:45.712Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-12T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--30333070-8824-4c5a-ba93-2680003f110d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.52.193.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T03:05:10.000Z",
      "valid_until": "2026-06-13T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T02:58:15.025Z",
      "x_nadsec_last_seen": "2026-05-12T02:58:15.025Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=IN; asn=132335; asn_org=LEAPSWITCH NETWORKS PRIVATE LIMITED; user(top)=r**t",
      "id": "indicator--27852f18-505c-411f-b330-46fc191be61a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.156.20.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 70,
      "x_nadsec_first_seen": "2026-05-12T03:55:18.529Z",
      "x_nadsec_last_seen": "2026-05-12T03:56:40.084Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132335"
      ],
      "x_nadsec_orgs": [
        "LEAPSWITCH NETWORKS PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--322ef0f8-95cd-41f3-990d-ca40fb8a65a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.75.72.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T04:04:29.557Z",
      "x_nadsec_last_seen": "2026-05-12T04:06:34.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=132199; asn_org=Globe Telecom Inc.",
      "id": "indicator--01c4dc4f-9873-4241-8dc9-b82ca12e49e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.28.110.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-12T04:01:02.551Z",
      "x_nadsec_last_seen": "2026-05-12T04:22:37.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "132199"
      ],
      "x_nadsec_orgs": [
        "Globe Telecom Inc."
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--4f97f50e-4c6f-432b-a0f7-9090aff1d10a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.122.138.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T03:58:51.271Z",
      "x_nadsec_last_seen": "2026-05-14T22:15:20.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=204102; asn_org=LLC SmartGrupp",
      "id": "indicator--83c3d7dc-96f4-4031-bac4-e5b2de8ad66b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.22.67.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-12T03:17:23.565Z",
      "x_nadsec_last_seen": "2026-05-20T20:05:51.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "204102"
      ],
      "x_nadsec_orgs": [
        "LLC SmartGrupp"
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b85044a7-0716-41fb-91f9-2f15f39303cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.110.179.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T03:06:31.702Z",
      "x_nadsec_last_seen": "2026-05-12T03:08:38.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--df7fae15-fce1-4f3b-b2ee-9042d056c0ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.185.138.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T04:02:42.094Z",
      "x_nadsec_last_seen": "2026-05-12T04:04:47.145Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--0a6217b6-08e5-48ec-b9f6-6a38fd9bc9ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.48.96.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T03:17:24.319Z",
      "x_nadsec_last_seen": "2026-05-12T03:23:42.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-12T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--9808a718-3ab9-4c42-b6b3-aee79e2e0be3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:05:10.000Z",
      "valid_until": "2026-06-13T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T03:31:52.135Z",
      "x_nadsec_last_seen": "2026-05-20T21:03:40.309Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--02e276f4-9f82-4675-9a74-c65fbf8ed80e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.93.66.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T04:42:36.515Z",
      "x_nadsec_last_seen": "2026-05-12T04:44:41.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--36775c5e-2ac9-474f-87f3-f3489539950d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.190.25.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T04:28:41.074Z",
      "x_nadsec_last_seen": "2026-05-12T04:30:45.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c29b4156-f26c-4731-a534-0c422eb5a872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.232.75.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T04:28:40.939Z",
      "x_nadsec_last_seen": "2026-05-12T04:30:44.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--62f6037e-41b1-4230-83bf-496a01350a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.254.81.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T04:09:34.731Z",
      "x_nadsec_last_seen": "2026-05-12T04:11:40.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--9d0967c8-0ec0-44ef-8ab5-aa7517abd3b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.76.246.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T04:38:03.500Z",
      "x_nadsec_last_seen": "2026-05-12T04:44:40.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=269096; asn_org=N&K TECNOLOGIA LTDA",
      "id": "indicator--3c2e4a94-46d0-4f93-a849-a62419736aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.232.94.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T04:27:29.453Z",
      "x_nadsec_last_seen": "2026-05-12T04:34:31.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "269096"
      ],
      "x_nadsec_orgs": [
        "N&K TECNOLOGIA LTDA"
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c5fc6822-3375-465c-bad6-e7d57b4e46a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.74.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T04:12:27.312Z",
      "x_nadsec_last_seen": "2026-05-20T05:42:54.929Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--c7abcf7d-5732-4442-8032-4b6472cf3ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-12T04:32:15.460Z",
      "x_nadsec_last_seen": "2026-05-12T04:32:55.714Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--933349f1-b952-421e-a52f-c3c8f7a47065",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.186.31.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T05:01:43.989Z",
      "x_nadsec_last_seen": "2026-05-12T05:05:17.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-12T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--d2f1c257-33a8-4a4b-b652-f2f46edc3db2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.57.159.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T05:05:11.000Z",
      "valid_until": "2026-06-13T05:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-12T04:11:56.535Z",
      "x_nadsec_last_seen": "2026-05-12T05:25:21.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=131275; asn_org=Logon Broadband Pvt. Limited",
      "id": "indicator--aed05d03-d8a2-428c-a77d-9f5b7d282245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.79.16.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T05:44:34.224Z",
      "x_nadsec_last_seen": "2026-05-12T05:46:39.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "131275"
      ],
      "x_nadsec_orgs": [
        "Logon Broadband Pvt. Limited"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--c98a3b5f-436c-457c-8996-c6dd37c6cfd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T05:49:15.064Z",
      "x_nadsec_last_seen": "2026-05-12T05:49:15.064Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PL; asn=215730; asn_org=H2nexus Ltd",
      "id": "indicator--459b8709-d3d9-4e5e-846d-0a8f6dd8809a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.31.3.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T05:28:55.699Z",
      "x_nadsec_last_seen": "2026-05-12T18:53:12.192Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "215730"
      ],
      "x_nadsec_orgs": [
        "H2nexus Ltd"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MD; asn=31252; asn_org=StarNet Solutii SRL",
      "id": "indicator--208b494b-cee5-45d6-a3ec-0be330017c1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.244.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T05:28:09.086Z",
      "x_nadsec_last_seen": "2026-05-12T05:30:15.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "31252"
      ],
      "x_nadsec_orgs": [
        "StarNet Solutii SRL"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--e9d6d28b-d5a0-49dd-bdce-0bf93c0e6d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T05:52:45.385Z",
      "x_nadsec_last_seen": "2026-05-12T15:02:41.297Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "213790"
      ],
      "x_nadsec_orgs": [
        "Limited Network LTD"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--40689725-0ad6-4cbd-a42c-c884ef00a04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.147.83.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T05:35:13.846Z",
      "x_nadsec_last_seen": "2026-05-12T05:42:04.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=24526; asn_org=Bina Nusantara University",
      "id": "indicator--220213cb-8ceb-4528-a5be-6a147490b8d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.58.178.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T05:18:24.514Z",
      "x_nadsec_last_seen": "2026-05-12T05:18:28.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24526"
      ],
      "x_nadsec_orgs": [
        "Bina Nusantara University"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--05be4457-f60b-4832-9b66-e11904439904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.14.124.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T05:16:26.044Z",
      "x_nadsec_last_seen": "2026-05-12T08:07:10.775Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1708; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--929c0893-3bf0-4450-bd95-271a37907beb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.93.65.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T06:05:10.000Z",
      "valid_until": "2026-06-13T06:05:09.000Z",
      "x_nadsec_event_count": 1708,
      "x_nadsec_first_seen": "2026-05-12T05:11:13.516Z",
      "x_nadsec_last_seen": "2026-05-12T05:30:17.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--595b89a7-2485-4c21-b1f9-2c2757a5cc65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.186.113.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T06:24:51.707Z",
      "x_nadsec_last_seen": "2026-05-12T06:26:56.512Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--fd01df41-1a81-42ff-88e3-e7b40911c86e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.171.20.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T07:03:30.735Z",
      "x_nadsec_last_seen": "2026-05-12T07:10:44.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--60e6dce9-8b80-4f0e-bf41-30be77c94225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T06:15:47.385Z",
      "x_nadsec_last_seen": "2026-05-12T06:15:47.385Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=45899; asn_org=VNPT Corp; user(top)=**",
      "id": "indicator--f57d1641-f1aa-47e6-98d8-166b2a1ec6f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.84.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T06:05:53.047Z",
      "x_nadsec_last_seen": "2026-05-31T14:55:42.248Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--6f607664-11ee-43ff-b2e4-1122f424af45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.245.54.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T06:30:18.464Z",
      "x_nadsec_last_seen": "2026-05-12T06:30:18.464Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=59497; asn_org=Buknet LLC",
      "id": "indicator--0991b459-1990-4982-b13e-d774563b885e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.110.103.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T06:58:54.253Z",
      "x_nadsec_last_seen": "2026-05-12T07:01:00.378Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "59497"
      ],
      "x_nadsec_orgs": [
        "Buknet LLC"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--9b9b86ef-c95b-4bc9-98b3-0dbbb5c478b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.45.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-12T06:39:58.994Z",
      "x_nadsec_last_seen": "2026-05-15T11:24:41.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--98e49c9b-180e-4814-bbf6-f23555bd87b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.241.235.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T06:42:30.390Z",
      "x_nadsec_last_seen": "2026-05-12T06:44:36.163Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company; user(top)=**",
      "id": "indicator--8a0b2752-2ac1-4925-8dd7-59d58f8eeb3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.80.39.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T06:41:08.131Z",
      "x_nadsec_last_seen": "2026-05-12T06:41:08.131Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--764ba615-e128-44bb-94d4-45534eb61bba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T06:18:11.264Z",
      "x_nadsec_last_seen": "2026-05-12T06:18:11.264Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--41887a75-9db2-4941-b924-805c0f4c8b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T06:18:11.863Z",
      "x_nadsec_last_seen": "2026-05-12T06:18:11.863Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--f28e7591-da7c-4e00-b424-2a3ea9a09fb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.213.202.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T06:56:47.703Z",
      "x_nadsec_last_seen": "2026-05-12T06:58:52.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=8697; asn_org=Jordan Telecommunications PSC",
      "id": "indicator--0d4f5759-1050-4685-9cfb-30fe7a666373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.34.13.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T06:45:49.632Z",
      "x_nadsec_last_seen": "2026-05-12T06:47:56.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8697"
      ],
      "x_nadsec_orgs": [
        "Jordan Telecommunications PSC"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--515bd823-4a4f-4fa7-9f75-522433cccf85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.184.146.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T06:51:24.841Z",
      "x_nadsec_last_seen": "2026-05-12T06:53:30.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-12T07:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC",
      "id": "indicator--a05f1bc9-a03a-4945-807c-27d124a8553d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T07:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.188.153.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T07:05:09.000Z",
      "valid_until": "2026-06-13T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T06:43:33.925Z",
      "x_nadsec_last_seen": "2026-05-12T06:45:40.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200590"
      ],
      "x_nadsec_orgs": [
        "NLS Kazakhstan LLC"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--632d06da-2c54-45ec-8e7b-1db5435e5e74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.46.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T07:44:54.070Z",
      "x_nadsec_last_seen": "2026-05-12T07:51:46.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--d7a0708a-59cc-4260-b00e-a815488cb6b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.87.57.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T07:52:49.230Z",
      "x_nadsec_last_seen": "2026-05-12T07:54:55.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--2763841b-dd58-4138-b663-5067824ea181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.102.66.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T07:55:43.606Z",
      "x_nadsec_last_seen": "2026-05-12T07:57:49.482Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ad66ec34-5c5d-427b-877a-d54f9b1b089d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.3.63.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T07:19:47.134Z",
      "x_nadsec_last_seen": "2026-05-12T07:19:47.220Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--40e12be6-ae86-45f2-a417-60fac9c562d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.25.85.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T07:30:39.917Z",
      "x_nadsec_last_seen": "2026-05-22T10:16:29.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=264351; asn_org=UNA TELECOMUNICACOES LTDA",
      "id": "indicator--6dfb676d-fa2f-4256-9707-bd5078ffb276",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '131.108.214.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T07:09:36.944Z",
      "x_nadsec_last_seen": "2026-05-12T07:11:43.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264351"
      ],
      "x_nadsec_orgs": [
        "UNA TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T07:06:33.792Z",
      "x_nadsec_last_seen": "2026-05-12T07:06:33.792Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bf158b07-8275-4a1f-88f7-cc72eb118837",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.144.114.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T07:32:51.769Z",
      "x_nadsec_last_seen": "2026-05-12T07:32:51.769Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2586888a-2f4f-4ef9-a63c-d4a59cbdd2b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.33.69.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T07:18:33.302Z",
      "x_nadsec_last_seen": "2026-05-12T07:25:40.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T07:34:20.314Z",
      "x_nadsec_last_seen": "2026-05-23T18:38:41.674Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--1b8b57ef-b643-4594-ab00-6bce73935c2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.141.135.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:05:10.000Z",
      "valid_until": "2026-06-13T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T07:39:59.228Z",
      "x_nadsec_last_seen": "2026-05-12T07:42:06.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=151690; asn_org=FAB FIVE NETWORK PRIVATE LIMITED",
      "id": "indicator--218682a0-c3b2-40db-8c62-aaa3887df362",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.239.13.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T08:22:13.851Z",
      "x_nadsec_last_seen": "2026-05-12T08:24:18.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151690"
      ],
      "x_nadsec_orgs": [
        "FAB FIVE NETWORK PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--31a6f2eb-fc2b-4d8b-b88d-18d5c6e33e1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.51.84.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T08:54:36.553Z",
      "x_nadsec_last_seen": "2026-05-12T08:56:42.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b5f2e74f-d7b8-46cb-98ea-7bafd2509bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.118.216.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T08:13:14.398Z",
      "x_nadsec_last_seen": "2026-05-12T08:13:24.575Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--3d9700c4-e2ee-4e62-a961-a688cab7d4ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.78.111.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T08:17:11.747Z",
      "x_nadsec_last_seen": "2026-05-12T08:23:53.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--2dcadb27-2ecc-448a-8b22-9fede8618a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.153.159.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T09:01:04.894Z",
      "x_nadsec_last_seen": "2026-05-12T09:08:59.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--8eee3341-81f3-4450-aa66-fddfe840d4a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.153.252.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T08:36:52.910Z",
      "x_nadsec_last_seen": "2026-05-22T17:26:01.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=NL; asn=205759; asn_org=Ghosty Networks LLC",
      "id": "indicator--0793acd2-c4e4-4047-a9e3-358238a4766a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-12T08:59:59.121Z",
      "x_nadsec_last_seen": "2026-05-12T09:06:44.701Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--145adc30-2a52-4b52-879b-99e6cca48ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.63.107.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T09:01:03.815Z",
      "x_nadsec_last_seen": "2026-05-12T09:03:10.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-12T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--5fca32a0-7f3d-4210-85ef-69609c464243",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.204.143.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:05:05.000Z",
      "valid_until": "2026-06-13T09:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T08:58:39.466Z",
      "x_nadsec_last_seen": "2026-05-12T09:05:11.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-12T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=37069; asn_org=MOBINIL",
      "id": "indicator--46acbabe-9426-476c-87ec-7b64ade4518d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.192.171.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:05:10.000Z",
      "valid_until": "2026-06-13T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T09:50:26.478Z",
      "x_nadsec_last_seen": "2026-05-12T09:52:33.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "37069"
      ],
      "x_nadsec_orgs": [
        "MOBINIL"
      ]
    },
    {
      "created": "2026-05-12T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--943a20d6-d7bf-4a88-a170-ff562bdfbb6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.156.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:05:10.000Z",
      "valid_until": "2026-06-13T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T09:20:16.524Z",
      "x_nadsec_last_seen": "2026-05-12T09:20:16.524Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138769; asn_org=JM OPTICAL FIBER SOLUTIONS PRIVATE LIMITED",
      "id": "indicator--c19abbb6-4c1a-41d7-96ed-92febe561c49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.66.104.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:05:10.000Z",
      "valid_until": "2026-06-13T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T09:05:25.567Z",
      "x_nadsec_last_seen": "2026-05-12T09:09:37.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138769"
      ],
      "x_nadsec_orgs": [
        "JM OPTICAL FIBER SOLUTIONS PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-12T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=2381; asn_org=WiscNet",
      "id": "indicator--11b43278-a96e-4ea0-8ff9-bde9b062a075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.56.34.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:05:10.000Z",
      "valid_until": "2026-06-13T10:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-12T09:53:28.620Z",
      "x_nadsec_last_seen": "2026-05-12T10:17:30.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "2381"
      ],
      "x_nadsec_orgs": [
        "WiscNet"
      ]
    },
    {
      "created": "2026-05-12T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--1d814bea-8778-4667-8d9a-7773e8adb693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.116.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:05:10.000Z",
      "valid_until": "2026-06-13T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T09:30:15.466Z",
      "x_nadsec_last_seen": "2026-05-12T09:30:39.582Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-12T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=60246; asn_org=Consumer Internet Cooperative PG-19",
      "id": "indicator--e0835a71-a575-4f39-af2f-808ef78e3cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.174.98.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:05:10.000Z",
      "valid_until": "2026-06-13T10:05:09.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-05-12T09:14:18.996Z",
      "x_nadsec_last_seen": "2026-05-24T11:44:42.047Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "60246"
      ],
      "x_nadsec_orgs": [
        "Consumer Internet Cooperative PG-19"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3d12547d-8143-40c6-a589-5caad4d326fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.36.109.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-12T10:17:09.995Z",
      "x_nadsec_last_seen": "2026-05-12T10:17:29.803Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1ed39798-75f4-424e-a0f3-8bc5234a000c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.129.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T10:54:56.598Z",
      "x_nadsec_last_seen": "2026-05-12T10:54:56.598Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--31e6df10-53d5-4d64-8fc5-a2fd833b732d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.165.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T10:54:59.283Z",
      "x_nadsec_last_seen": "2026-05-14T00:29:14.672Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--1bd16588-17c6-42d0-bcbc-a2116691ab45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.18.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T10:41:57.397Z",
      "x_nadsec_last_seen": "2026-05-12T10:44:04.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--e8f2a6bb-f205-46b1-8331-b8569c09ce7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.253.128.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T10:50:46.873Z",
      "x_nadsec_last_seen": "2026-05-19T09:52:18.082Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=UA; asn=25403; asn_org=Firm Delta PE",
      "id": "indicator--78493126-f11b-4a6c-b169-6f6328322686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.20.125.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T10:40:32.904Z",
      "x_nadsec_last_seen": "2026-05-12T10:54:48.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "25403"
      ],
      "x_nadsec_orgs": [
        "Firm Delta PE"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d2f9aff3-86c8-404d-9400-a8f568316b4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.199.121.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T10:54:57.234Z",
      "x_nadsec_last_seen": "2026-05-12T10:54:57.234Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=132115; asn_org=INDINET SERVICE PRIVATE LIMITED",
      "id": "indicator--a8ae6a3c-af48-4a8f-92c1-98bcd601b2df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.142.101.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T10:53:22.829Z",
      "x_nadsec_last_seen": "2026-05-12T10:59:55.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132115"
      ],
      "x_nadsec_orgs": [
        "INDINET SERVICE PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--258f9adf-d3ba-47b4-9c55-6d1e48f1d39b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.186.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T10:07:25.128Z",
      "x_nadsec_last_seen": "2026-05-12T10:07:25.485Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2f0d5dff-2d01-448b-82ab-967bed2f80cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T11:05:10.000Z",
      "valid_until": "2026-06-13T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T10:09:09.449Z",
      "x_nadsec_last_seen": "2026-05-12T10:09:10.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--78e2af2e-1f8a-44f0-b203-4f0b7aeb110f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.118.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T12:08:48.045Z",
      "x_nadsec_last_seen": "2026-05-12T12:08:55.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group; user(top)=**",
      "id": "indicator--94d17ef8-f813-428e-ac27-d0882d1042bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.163.231.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T12:20:09.552Z",
      "x_nadsec_last_seen": "2026-05-12T12:20:09.552Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c83af17b-4631-4841-8fbb-0fa983ddf9fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.166.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T12:47:00.885Z",
      "x_nadsec_last_seen": "2026-05-12T12:47:02.537Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--afac0980-7d22-463c-80ec-868748b6b0f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.73.225.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T12:13:09.107Z",
      "x_nadsec_last_seen": "2026-05-12T12:13:38.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--15a96ab0-223e-4172-b251-550a4daa9fa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.50.8.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T12:08:23.683Z",
      "x_nadsec_last_seen": "2026-05-12T12:10:30.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1d044d19-68e0-4dd9-abc1-4271aa530bdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.7.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T12:07:02.311Z",
      "x_nadsec_last_seen": "2026-05-12T12:07:13.594Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12730; asn_org=Rostelecom",
      "id": "indicator--a8812640-b54f-4a42-93be-ea3c0686dfc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.26.245.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T12:53:14.582Z",
      "x_nadsec_last_seen": "2026-05-12T12:57:46.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12730"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--606c4523-6db1-49f7-9849-f0b02e4d8ffa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.241.130.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T12:42:35.052Z",
      "x_nadsec_last_seen": "2026-05-23T17:19:45.034Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--795586c5-d74c-443f-bd31-c41f41425eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T12:29:04.644Z",
      "x_nadsec_last_seen": "2026-05-12T12:29:04.644Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-12T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e19e2a46-ea06-4a56-b25b-ef27b1d521a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:05:10.000Z",
      "valid_until": "2026-06-13T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T12:29:09.027Z",
      "x_nadsec_last_seen": "2026-05-12T12:29:09.027Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-12T14:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--aff37510-7dad-4687-9eb0-a9d0987a432f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.59.108.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:05:26.000Z",
      "valid_until": "2026-06-13T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T13:28:47.501Z",
      "x_nadsec_last_seen": "2026-05-12T13:28:52.393Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-12T14:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--485cff79-30c6-4952-84eb-27a0a4785105",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:05:26.000Z",
      "valid_until": "2026-06-13T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T13:51:11.198Z",
      "x_nadsec_last_seen": "2026-05-12T13:51:11.198Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-12T14:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--6b485feb-892e-4fc7-84f1-1813456171ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.110.24.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:05:26.000Z",
      "valid_until": "2026-06-13T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T14:02:58.401Z",
      "x_nadsec_last_seen": "2026-05-12T14:05:06.302Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-05-12T14:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--301a197d-04fc-4522-b12a-615f0d910271",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:05:26.000Z",
      "valid_until": "2026-06-13T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T13:46:56.386Z",
      "x_nadsec_last_seen": "2026-05-12T13:46:56.386Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T14:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T14:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:05:26.000Z",
      "valid_until": "2026-06-13T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T13:34:07.871Z",
      "x_nadsec_last_seen": "2026-05-12T13:34:07.871Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--5280637d-f44d-425e-a7a8-7a1a53451cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.191.151.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:05:10.000Z",
      "valid_until": "2026-06-13T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T14:40:19.413Z",
      "x_nadsec_last_seen": "2026-05-12T14:40:19.413Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-05-12T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--4843d525-fcaf-43ec-a271-0f20ffb0c42f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.191.151.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:05:10.000Z",
      "valid_until": "2026-06-13T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T14:38:14.388Z",
      "x_nadsec_last_seen": "2026-05-12T14:40:21.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-05-12T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--41dea916-faa1-4282-a41d-fed08add327f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.168.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:05:10.000Z",
      "valid_until": "2026-06-13T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T14:05:33.435Z",
      "x_nadsec_last_seen": "2026-05-12T14:05:33.435Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--5c6426f0-3519-48be-9859-db09d59c10c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.72.207.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:05:10.000Z",
      "valid_until": "2026-06-13T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T14:38:55.864Z",
      "x_nadsec_last_seen": "2026-05-12T14:41:05.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-05-12T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--7c830e8b-89dc-46a3-bbe3-da575188c5e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.49.242.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T15:05:10.000Z",
      "valid_until": "2026-06-13T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T14:18:08.414Z",
      "x_nadsec_last_seen": "2026-05-12T14:24:49.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-12T16:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--390191c7-1307-4d90-90b2-07673d6e332e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.237.209.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:05:25.000Z",
      "valid_until": "2026-06-13T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T15:07:20.403Z",
      "x_nadsec_last_seen": "2026-05-12T15:09:27.627Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-12T16:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--2bdbf8e3-1974-49fe-9696-6ba2beae91c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.49.122.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:05:25.000Z",
      "valid_until": "2026-06-13T16:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T15:34:51.461Z",
      "x_nadsec_last_seen": "2026-05-14T16:51:27.503Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-12T16:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--5e61f47a-093f-480e-a549-612c76a1ef86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.6.47.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:05:25.000Z",
      "valid_until": "2026-06-13T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T15:55:57.882Z",
      "x_nadsec_last_seen": "2026-05-12T15:58:03.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-05-12T16:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--b94457b1-8b98-48d4-bdc0-3645e6cc7a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.82.75.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:05:25.000Z",
      "valid_until": "2026-06-13T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T15:50:26.205Z",
      "x_nadsec_last_seen": "2026-05-12T15:52:30.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-12T16:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4d6f2e20-6984-4b80-999b-b98169784806",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:05:25.000Z",
      "valid_until": "2026-06-13T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T15:41:32.100Z",
      "x_nadsec_last_seen": "2026-05-27T22:49:23.736Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T16:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--86646c59-18ae-490d-9870-076e747d923c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.38.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:05:25.000Z",
      "valid_until": "2026-06-13T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T15:54:10.121Z",
      "x_nadsec_last_seen": "2026-05-12T15:54:10.422Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T16:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=209489; asn_org=Azintex.com LLC",
      "id": "indicator--1ea5de94-d8f5-4ef0-92d8-f57459f9e4ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T16:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.132.5.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:05:25.000Z",
      "valid_until": "2026-06-13T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T15:25:13.736Z",
      "x_nadsec_last_seen": "2026-05-12T15:27:20.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "209489"
      ],
      "x_nadsec_orgs": [
        "Azintex.com LLC"
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--380dea1e-5ab2-4458-9a4a-8c07d7b43358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.226.2.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-12T16:27:30.360Z",
      "x_nadsec_last_seen": "2026-05-12T16:27:51.573Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!*******e"
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--819072aa-8eda-4c51-ab66-517e9ae5a2c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.224.144.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T16:17:55.494Z",
      "x_nadsec_last_seen": "2026-05-12T16:17:55.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=27879; asn_org=Informatica y Telecomunicaciones S.A.",
      "id": "indicator--3ea7d423-6a6b-42d5-83cd-eb706094b8d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.15.205.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T16:20:15.295Z",
      "x_nadsec_last_seen": "2026-05-12T17:22:17.149Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27879"
      ],
      "x_nadsec_orgs": [
        "Informatica y Telecomunicaciones S.A."
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e866a615-a212-4b50-9366-62ecfb06df53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T16:27:56.335Z",
      "x_nadsec_last_seen": "2026-05-12T16:27:56.335Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=28015; asn_org=MERCO COMUNICACIONES",
      "id": "indicator--e4b1120d-f8c8-422a-bb0b-6647ebfff5ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.219.168.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T16:13:33.739Z",
      "x_nadsec_last_seen": "2026-05-12T16:21:39.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28015"
      ],
      "x_nadsec_orgs": [
        "MERCO COMUNICACIONES"
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom; user(top)=***; pass(top)=1**1",
      "id": "indicator--5f8a9013-b575-4088-a869-39bdfe339012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.97.6.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T16:30:52.539Z",
      "x_nadsec_last_seen": "2026-05-12T16:30:52.539Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "1**1"
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--6e2ecb29-d08a-46a3-8dfc-5221ba4af758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.190.61.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T16:22:21.579Z",
      "x_nadsec_last_seen": "2026-05-12T16:30:09.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-05-12T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12714; asn_org=PJSC MegaFon",
      "id": "indicator--21d80e89-0c4c-4bfb-8d66-1ce864b70f0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.73.65.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T17:05:12.000Z",
      "valid_until": "2026-06-13T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T16:42:38.692Z",
      "x_nadsec_last_seen": "2026-05-12T16:44:45.248Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12714"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31626; asn_org=OOO ZVI Telecom",
      "id": "indicator--046b4ee8-0e6c-4127-951d-e5323820f69c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.64.163.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:05:10.000Z",
      "valid_until": "2026-06-13T18:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-12T17:19:51.009Z",
      "x_nadsec_last_seen": "2026-05-23T05:21:52.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31626"
      ],
      "x_nadsec_orgs": [
        "OOO ZVI Telecom"
      ]
    },
    {
      "created": "2026-05-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--49dd85ea-94eb-4dbc-be0b-1e1832de3174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.102.117.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:05:10.000Z",
      "valid_until": "2026-06-13T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T17:34:43.644Z",
      "x_nadsec_last_seen": "2026-05-12T17:34:53.843Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--da315a0d-3c18-49cd-bbd3-f125de8768c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.80.105.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:05:10.000Z",
      "valid_until": "2026-06-13T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T18:00:00.872Z",
      "x_nadsec_last_seen": "2026-05-30T23:05:02.099Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:05:10.000Z",
      "valid_until": "2026-06-13T18:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-12T17:58:15.098Z",
      "x_nadsec_last_seen": "2026-05-24T07:38:06.007Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "81",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--f9fb1c66-65d1-4a30-aa66-f84892f093a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.195.158.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:05:10.000Z",
      "valid_until": "2026-06-13T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T17:49:19.242Z",
      "x_nadsec_last_seen": "2026-05-12T17:51:35.954Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-12T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--feb2410f-f181-41f9-80e5-26c1bfec0def",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.98.50.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:05:10.000Z",
      "valid_until": "2026-06-13T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T17:54:13.885Z",
      "x_nadsec_last_seen": "2026-05-12T17:56:19.373Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f6f4fb69-e71e-4828-8ede-0412d1a56d9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.47.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T19:02:43.557Z",
      "x_nadsec_last_seen": "2026-05-12T19:03:06.681Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--efc2fc6e-9df2-438d-9fd6-43f26ca93fc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.161.46.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T19:01:52.770Z",
      "x_nadsec_last_seen": "2026-05-12T19:08:19.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--00e1863b-b931-4cec-960f-185add6e072e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.58.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T18:56:31.421Z",
      "x_nadsec_last_seen": "2026-05-12T18:57:00.527Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--79d4877f-8632-4c8d-b5c4-74ac0be0c167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.176.87.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T18:50:58.744Z",
      "x_nadsec_last_seen": "2026-05-12T18:53:04.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2eebb645-49ec-4964-809a-077508a5dadc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.62.218.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T18:18:20.584Z",
      "x_nadsec_last_seen": "2026-05-12T18:18:20.584Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--9545acec-9075-4845-89bb-479912e5e610",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.50.232.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T18:15:26.278Z",
      "x_nadsec_last_seen": "2026-05-12T18:15:26.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--821a4e0d-da33-45ef-9543-e470f5bbaef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.199.191.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T18:12:52.844Z",
      "x_nadsec_last_seen": "2026-05-12T18:15:00.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-12T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--5b6558c9-d1ce-4c39-9280-53f80a392922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.95.168.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T19:05:05.000Z",
      "valid_until": "2026-06-13T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T18:11:36.661Z",
      "x_nadsec_last_seen": "2026-05-12T18:13:43.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--98ed9db0-fe3d-4edf-8740-fb420b703476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.36.121.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T20:03:57.135Z",
      "x_nadsec_last_seen": "2026-05-12T20:10:25.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=pptpd; ports=1723; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.23.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T19:50:55.531Z",
      "x_nadsec_last_seen": "2026-05-12T19:53:24.048Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b07c1486-39ce-4f9b-9891-544f36d3454f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T19:21:43.775Z",
      "x_nadsec_last_seen": "2026-05-12T19:21:43.775Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--e60a0632-a32e-461e-aeba-76b48411e7fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.230.143.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T19:12:11.073Z",
      "x_nadsec_last_seen": "2026-05-12T19:12:51.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--2d80f0b3-eeef-445e-83d9-7b94f6e50850",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.33.94.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T19:21:07.623Z",
      "x_nadsec_last_seen": "2026-05-12T19:23:14.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=201086; asn_org=ServerPlusInternet Sunucu Hizmetleri; user(top)=**",
      "id": "indicator--abfdeff7-a03f-48c4-805c-11aba2c574bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.254.95.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T19:05:44.648Z",
      "x_nadsec_last_seen": "2026-05-30T16:30:07.236Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "201086"
      ],
      "x_nadsec_orgs": [
        "ServerPlusInternet Sunucu Hizmetleri"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--d132820b-bbfa-4a78-817e-65743706751c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.119.150.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T19:06:15.042Z",
      "x_nadsec_last_seen": "2026-05-12T19:07:09.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5a7f829a-a562-4c65-bfaf-42fd0009b820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.15.201.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-12T19:30:39.052Z",
      "x_nadsec_last_seen": "2026-05-28T11:03:03.366Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T19:15:02.130Z",
      "x_nadsec_last_seen": "2026-05-29T20:14:15.180Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--2d527bd1-edb5-4c01-8460-ecc736f9321f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.196.19.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-12T20:03:01.639Z",
      "x_nadsec_last_seen": "2026-05-12T20:08:01.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--47a16119-fb6c-4ab6-842a-247316e74d1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T19:31:46.002Z",
      "x_nadsec_last_seen": "2026-05-30T05:10:30.900Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3ed08db9-7404-4d0e-a375-e119159182b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-12T19:30:32.537Z",
      "x_nadsec_last_seen": "2026-05-23T07:57:14.623Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1a75f5bd-8e8e-4f11-8310-c5b215eb8565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T19:31:52.069Z",
      "x_nadsec_last_seen": "2026-05-20T20:31:51.816Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RO; asn=204428; asn_org=SS-Net",
      "id": "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T20:05:11.000Z",
      "valid_until": "2026-06-13T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T19:21:51.126Z",
      "x_nadsec_last_seen": "2026-05-12T19:21:51.126Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "204428"
      ],
      "x_nadsec_orgs": [
        "SS-Net"
      ]
    },
    {
      "created": "2026-05-12T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.181.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:05:10.000Z",
      "valid_until": "2026-06-13T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T20:24:57.893Z",
      "x_nadsec_last_seen": "2026-05-12T20:25:17.396Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-12T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52630; asn_org=MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO",
      "id": "indicator--d407bcd8-ad58-4dfb-a6c5-39b15a6ea991",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.233.6.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:05:10.000Z",
      "valid_until": "2026-06-13T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T20:06:47.617Z",
      "x_nadsec_last_seen": "2026-05-12T20:07:01.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52630"
      ],
      "x_nadsec_orgs": [
        "MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO"
      ]
    },
    {
      "created": "2026-05-12T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262807; asn_org=Redfox Telecomunicacoes Ltda.",
      "id": "indicator--4e799108-8c43-4be4-a25d-65b322684e16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.53.202.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:05:10.000Z",
      "valid_until": "2026-06-13T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T20:28:46.901Z",
      "x_nadsec_last_seen": "2026-05-12T20:36:09.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262807"
      ],
      "x_nadsec_orgs": [
        "Redfox Telecomunicacoes Ltda."
      ]
    },
    {
      "created": "2026-05-12T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=36937; asn_org=Neotel",
      "id": "indicator--a7ae4174-9a35-4225-afe4-342e74751a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.162.56.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:05:10.000Z",
      "valid_until": "2026-06-13T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T20:15:49.738Z",
      "x_nadsec_last_seen": "2026-05-12T20:15:49.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36937"
      ],
      "x_nadsec_orgs": [
        "Neotel"
      ]
    },
    {
      "created": "2026-05-12T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=26077; asn_org=Nextlink Broadband",
      "id": "indicator--886ae124-2d36-41a6-88f6-03383b0f42e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.128.53.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:05:10.000Z",
      "valid_until": "2026-06-13T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T20:05:40.250Z",
      "x_nadsec_last_seen": "2026-05-18T19:24:15.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "26077"
      ],
      "x_nadsec_orgs": [
        "Nextlink Broadband"
      ]
    },
    {
      "created": "2026-05-12T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--54a8cc90-e226-448e-9a15-89fdb7dfad7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.80.220.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:05:10.000Z",
      "valid_until": "2026-06-13T21:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-12T20:57:19.185Z",
      "x_nadsec_last_seen": "2026-05-16T19:40:03.057Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--8819c270-e944-442d-a278-b2e4a52b188d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.17.90.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 3160,
      "x_nadsec_first_seen": "2026-05-12T21:10:13.829Z",
      "x_nadsec_last_seen": "2026-05-13T18:18:31.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b9393dde-4ae7-4e26-af73-d81d37f89a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T21:25:43.985Z",
      "x_nadsec_last_seen": "2026-05-12T21:25:43.985Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--afcf3f8c-1531-4c3a-a0ec-a1c5fb53668a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.239.114.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T21:28:47.969Z",
      "x_nadsec_last_seen": "2026-05-12T21:30:54.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e2aa08f1-6638-42a3-bb52-e921a3d34faf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.253.80.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T21:20:05.783Z",
      "x_nadsec_last_seen": "2026-05-12T21:22:10.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8749; asn_org=JSC Redcom-lnternet",
      "id": "indicator--7362e172-530f-4c7e-b042-0867fc5aad3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.183.134.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T21:13:40.378Z",
      "x_nadsec_last_seen": "2026-05-12T21:21:58.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8749"
      ],
      "x_nadsec_orgs": [
        "JSC Redcom-lnternet"
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NL; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--42f864af-10b5-4ee6-a464-d599e56a96d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '57.153.203.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T21:30:52.369Z",
      "x_nadsec_last_seen": "2026-05-12T21:30:52.369Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0cc2821e-5dc9-4b8c-b9d9-bd8c7434abaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T21:35:48.970Z",
      "x_nadsec_last_seen": "2026-05-12T21:35:48.970Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-12T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--f5a154f7-4406-4f70-9dcb-6c3065b7eb53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.175.0.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:05:10.000Z",
      "valid_until": "2026-06-13T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T21:37:01.826Z",
      "x_nadsec_last_seen": "2026-05-12T21:45:01.385Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=CZ; asn=62212; asn_org=SmartApe OU",
      "id": "indicator--f242966d-6eb9-4ecf-92ad-8cf1d8439151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.172.8.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T22:25:27.141Z",
      "x_nadsec_last_seen": "2026-05-13T01:18:20.192Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CZ"
      ],
      "x_nadsec_asns": [
        "62212"
      ],
      "x_nadsec_orgs": [
        "SmartApe OU"
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6747dd19-0fd5-475d-b6a9-0c42a12dccbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.26.71.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T22:32:09.264Z",
      "x_nadsec_last_seen": "2026-05-12T22:34:14.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3b345870-2f37-468b-86ad-ed9175c93a62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.187.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-12T22:32:43.335Z",
      "x_nadsec_last_seen": "2026-05-12T22:39:19.731Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--3d2afb89-00e6-4772-9d91-9686a9df7c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.181.60.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T22:19:51.944Z",
      "x_nadsec_last_seen": "2026-05-12T22:21:58.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--76003846-2009-4180-9e0d-f95980728fed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.116.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T22:38:21.165Z",
      "x_nadsec_last_seen": "2026-05-12T22:38:21.165Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b3da3872-51d4-4a54-8812-f0d1c7e14736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T22:20:16.084Z",
      "x_nadsec_last_seen": "2026-05-12T22:20:16.084Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--0d3bb8cf-b7f3-46c7-b357-2a5f3fd2b549",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T22:16:27.521Z",
      "x_nadsec_last_seen": "2026-05-12T22:16:27.525Z",
      "x_nadsec_ports": [
        "42",
        "38997"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--375bbac7-8d08-412d-b3db-8f04f737243c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T22:22:23.925Z",
      "x_nadsec_last_seen": "2026-05-12T22:22:23.925Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c206b923-4b51-4bae-ab54-b2358489c453",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T23:02:10.893Z",
      "x_nadsec_last_seen": "2026-05-12T23:02:10.897Z",
      "x_nadsec_ports": [
        "42",
        "34497"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-12T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--01ac56dc-ed05-4559-bb31-dbc1396964ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-12T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:05:10.000Z",
      "valid_until": "2026-06-13T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-12T23:02:11.961Z",
      "x_nadsec_last_seen": "2026-05-12T23:02:11.965Z",
      "x_nadsec_ports": [
        "42",
        "38463"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--3f467f41-d44d-4517-a9f3-2d657fdfe4ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.225.13.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:05:11.000Z",
      "valid_until": "2026-06-14T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-12T23:16:15.193Z",
      "x_nadsec_last_seen": "2026-05-13T00:10:58.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=59165; asn_org=Auspice Infratel Pvt. Ltd.",
      "id": "indicator--abd93a7b-1c2a-4199-81e2-ca81e3508368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.231.47.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:05:11.000Z",
      "valid_until": "2026-06-14T00:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T23:46:38.694Z",
      "x_nadsec_last_seen": "2026-05-13T10:38:32.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59165"
      ],
      "x_nadsec_orgs": [
        "Auspice Infratel Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--cad82ac0-f0f0-48f5-be80-c773fe17f649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:05:11.000Z",
      "valid_until": "2026-06-14T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T23:07:35.451Z",
      "x_nadsec_last_seen": "2026-05-12T23:07:35.451Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:05:11.000Z",
      "valid_until": "2026-06-14T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T23:38:22.809Z",
      "x_nadsec_last_seen": "2026-05-12T23:38:22.809Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--30f3d151-b254-4285-a054-b47c953279af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.118.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:05:11.000Z",
      "valid_until": "2026-06-14T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-12T23:57:35.739Z",
      "x_nadsec_last_seen": "2026-05-12T23:57:35.739Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--aad36837-973c-480b-a577-b0f6e025ea10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.230.15.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:05:11.000Z",
      "valid_until": "2026-06-14T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T23:41:07.854Z",
      "x_nadsec_last_seen": "2026-05-12T23:43:14.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-13T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--46ff4cd6-c635-46b0-ad17-19df42e2733f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.84.100.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T00:05:11.000Z",
      "valid_until": "2026-06-14T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-12T23:27:27.467Z",
      "x_nadsec_last_seen": "2026-05-12T23:29:33.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a94435a9-7213-49f2-9691-70e1651fca32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.46.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T00:32:22.472Z",
      "x_nadsec_last_seen": "2026-05-13T00:34:27.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--5568d07f-1b6d-4316-b2a6-d1d0414a7f11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.172.93.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-13T00:27:44.807Z",
      "x_nadsec_last_seen": "2026-05-25T14:13:30.383Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8e4c6cfb-fd4e-4f5c-8385-75231417140d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T00:48:59.062Z",
      "x_nadsec_last_seen": "2026-05-13T00:48:59.062Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--198b008b-de57-4119-8a1d-a5539db93185",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-13T00:25:47.860Z",
      "x_nadsec_last_seen": "2026-05-17T16:05:49.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=263432; asn_org=CORPORATIVA TELECOMUNICACOES EIRELI ME",
      "id": "indicator--867f5a72-165e-4979-93d1-e27f4749cf98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.91.77.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T00:27:23.134Z",
      "x_nadsec_last_seen": "2026-05-13T00:28:14.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263432"
      ],
      "x_nadsec_orgs": [
        "CORPORATIVA TELECOMUNICACOES EIRELI ME"
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e95dbc52-cce9-4ee1-95db-5b79279ff8d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.172.48.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T00:29:05.261Z",
      "x_nadsec_last_seen": "2026-05-13T00:31:10.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SE; asn=136787; asn_org=PacketHub S.A.",
      "id": "indicator--5d7f98a2-951b-4afe-b340-fb4234ba8a43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.46.242.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T00:47:29.303Z",
      "x_nadsec_last_seen": "2026-05-13T00:47:29.303Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "136787"
      ],
      "x_nadsec_orgs": [
        "PacketHub S.A."
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5ab202cc-13cf-486f-afab-5b20c8390854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T00:17:16.043Z",
      "x_nadsec_last_seen": "2026-05-13T00:17:16.043Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=62240; asn_org=Clouvider Limited; user(top)=r**t",
      "id": "indicator--48c2f9ec-66ae-47d8-9184-b743b82d22dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.128.199.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T00:52:07.227Z",
      "x_nadsec_last_seen": "2026-05-13T00:52:07.227Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "62240"
      ],
      "x_nadsec_orgs": [
        "Clouvider Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--1d433c87-17bc-4f1d-9e83-871d43831326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.226.154.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:05:10.000Z",
      "valid_until": "2026-06-14T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T00:50:29.383Z",
      "x_nadsec_last_seen": "2026-05-13T00:50:29.383Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-13T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--52e0c128-0f6f-4e4d-9db0-e3cd947521f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.185.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:05:11.000Z",
      "valid_until": "2026-06-14T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T01:47:00.938Z",
      "x_nadsec_last_seen": "2026-05-13T01:53:53.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-13T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--a264d333-544a-489a-a03a-9490316b919f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.69.178.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:05:11.000Z",
      "valid_until": "2026-06-14T02:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-13T01:59:47.912Z",
      "x_nadsec_last_seen": "2026-05-18T23:49:28.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-13T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--7843eedf-9be0-4427-9cab-8746bd594515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.91.83.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:05:11.000Z",
      "valid_until": "2026-06-14T02:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T01:43:13.390Z",
      "x_nadsec_last_seen": "2026-05-13T01:43:38.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-05-13T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e4c9187a-d97f-4a16-a3c7-43142d47c545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:05:11.000Z",
      "valid_until": "2026-06-14T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T01:09:24.310Z",
      "x_nadsec_last_seen": "2026-05-13T01:09:24.310Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:05:11.000Z",
      "valid_until": "2026-06-14T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T01:08:54.392Z",
      "x_nadsec_last_seen": "2026-05-25T20:04:00.367Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--adac3497-ef51-4e83-880b-0fdf4f2c844a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.189.214.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:05:11.000Z",
      "valid_until": "2026-06-14T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T01:33:48.734Z",
      "x_nadsec_last_seen": "2026-05-13T01:33:48.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--7ff08381-104e-4a0e-84d9-c9670bdc433c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.65.110.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:05:11.000Z",
      "valid_until": "2026-06-14T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T01:38:12.206Z",
      "x_nadsec_last_seen": "2026-05-13T01:40:16.577Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--afd0169d-ab65-4253-b0f8-87a67071c6c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.187.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T03:48:35.395Z",
      "x_nadsec_last_seen": "2026-05-13T03:50:40.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--66db2039-57a9-4425-bcbc-fd22bf71c2e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.242.168.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T03:41:04.842Z",
      "x_nadsec_last_seen": "2026-05-13T03:41:04.842Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--9dc13697-570b-4e1d-9137-e7e4ebd83f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.8.227.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T03:27:23.262Z",
      "x_nadsec_last_seen": "2026-05-13T03:29:36.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--34344c3b-1cb6-432e-b47b-3500cadb7322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.114.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-13T04:05:02.638Z",
      "x_nadsec_last_seen": "2026-05-21T11:57:26.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T03:49:06.452Z",
      "x_nadsec_last_seen": "2026-05-16T19:08:48.485Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4a8e9fde-1ad0-49ec-a7da-457e0da973c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.15.200.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T03:08:16.911Z",
      "x_nadsec_last_seen": "2026-05-13T03:08:17.611Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0d0e9c57-88c1-460a-a079-a72b535a11a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.252.127.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T03:34:08.081Z",
      "x_nadsec_last_seen": "2026-05-13T03:36:12.817Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6cb146dd-f13d-40b5-9c84-3dc14ac8cc83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.250.193.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T04:05:10.000Z",
      "valid_until": "2026-06-14T04:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-13T03:16:18.072Z",
      "x_nadsec_last_seen": "2026-05-13T04:45:23.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ca2fa4b3-b55e-48ff-83db-d42ead446248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.220.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T04:08:58.205Z",
      "x_nadsec_last_seen": "2026-05-13T04:11:03.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4fe7e189-0150-4b4b-9ba9-44c31e5c587b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.144.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T04:07:32.565Z",
      "x_nadsec_last_seen": "2026-05-13T04:07:32.728Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bb07f921-22f0-441d-8559-2c12fc44804c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.33.66.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T04:10:55.697Z",
      "x_nadsec_last_seen": "2026-05-13T04:10:55.697Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=265317; asn_org=TRIXNET SERVICOS DE TELEINFORMATICA LTDA",
      "id": "indicator--70f65642-c4af-429f-ac05-2dad3709e21c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.121.99.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T04:07:16.889Z",
      "x_nadsec_last_seen": "2026-05-13T04:09:24.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265317"
      ],
      "x_nadsec_orgs": [
        "TRIXNET SERVICOS DE TELEINFORMATICA LTDA"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--93787edb-90fd-4b37-8b1b-e2ae8e7064de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.168.226.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T04:08:54.884Z",
      "x_nadsec_last_seen": "2026-05-13T04:15:31.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CL; asn=15311; asn_org=TELEFONICA EMPRESAS CHILE SA",
      "id": "indicator--cd67f199-85df-4dba-ab26-b6a553ee33ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.82.105.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T04:54:17.963Z",
      "x_nadsec_last_seen": "2026-05-13T04:56:41.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "15311"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA EMPRESAS CHILE SA"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b1e4c4ea-84fa-411c-b2ea-b0d769b1613e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T04:33:36.142Z",
      "x_nadsec_last_seen": "2026-05-13T04:33:36.142Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--06c4fe06-3693-4486-9b1a-da22c13cd0b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T04:33:36.653Z",
      "x_nadsec_last_seen": "2026-05-13T04:33:36.653Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--1f0f53cd-ec7b-4933-bef0-80a113fa12c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.187.227.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T04:43:10.557Z",
      "x_nadsec_last_seen": "2026-05-13T04:45:15.619Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--25ef5c57-a5e1-4337-91fc-da4cd2e210b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.172.142.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T04:20:44.819Z",
      "x_nadsec_last_seen": "2026-05-13T04:27:02.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=BR; asn=267173; asn_org=NetMontes Telecomunicacoes e Servicos Ltda",
      "id": "indicator--5730d05d-406a-46fe-b9cd-8efe90699b08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.230.177.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-13T04:23:13.937Z",
      "x_nadsec_last_seen": "2026-05-13T04:37:48.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267173"
      ],
      "x_nadsec_orgs": [
        "NetMontes Telecomunicacoes e Servicos Ltda"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--70687746-088c-4769-a69b-5d70cb92226c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.137.109.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-13T04:44:46.724Z",
      "x_nadsec_last_seen": "2026-05-29T14:15:11.942Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T04:50:25.407Z",
      "x_nadsec_last_seen": "2026-05-13T04:50:25.407Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-13T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=8814; asn_org=Aztelekom LLC; user(top)=**",
      "id": "indicator--d3f5a9e8-16e3-403e-b603-bfe707f67634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.69.55.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:05:05.000Z",
      "valid_until": "2026-06-14T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T04:13:01.046Z",
      "x_nadsec_last_seen": "2026-05-16T15:00:46.094Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=140171; asn_org=Reis Network Solutions",
      "id": "indicator--7d328429-ed89-414a-ad14-943a3a342219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.156.201.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T05:48:02.335Z",
      "x_nadsec_last_seen": "2026-05-13T05:50:07.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "140171"
      ],
      "x_nadsec_orgs": [
        "Reis Network Solutions"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c36155d1-d389-4d60-a014-b9be3dac4f4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.197.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T05:50:17.495Z",
      "x_nadsec_last_seen": "2026-05-13T05:57:28.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7f2d0efd-416e-4b0a-b6dc-31f8b57a0c2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.54.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T05:15:28.964Z",
      "x_nadsec_last_seen": "2026-05-13T05:15:28.964Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--06b896e1-e180-4750-90a4-75fdee807a12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.193.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-13T05:50:16.438Z",
      "x_nadsec_last_seen": "2026-05-16T14:26:31.018Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--bf77d3ce-1e5e-4fad-b4b7-d58b7dcd1e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.10.99.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T05:08:37.749Z",
      "x_nadsec_last_seen": "2026-05-13T05:10:43.709Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1b7ff201-66bd-40cf-870e-a931acfa6fa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T05:24:23.307Z",
      "x_nadsec_last_seen": "2026-05-13T05:24:33.660Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=30600; asn_org=Metronet",
      "id": "indicator--985c1fcb-f4c8-4fa7-a11a-dcc84591853c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.82.43.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T05:47:20.591Z",
      "x_nadsec_last_seen": "2026-05-13T05:54:32.719Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "30600"
      ],
      "x_nadsec_orgs": [
        "Metronet"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--a366b5c8-28b0-4467-aabf-98f57f99f01e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.240.205.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T05:14:10.609Z",
      "x_nadsec_last_seen": "2026-05-25T08:35:49.819Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9a67c57a-050a-4fcf-8baf-2513bcdfe85a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.100.62.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-13T05:29:43.370Z",
      "x_nadsec_last_seen": "2026-05-13T06:07:00.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-13T06:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--43fc7953-2520-4b3d-98e1-8df8049b5387",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T06:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.188.50.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T06:05:13.000Z",
      "valid_until": "2026-06-14T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T05:39:06.543Z",
      "x_nadsec_last_seen": "2026-05-13T05:41:13.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-13T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--cb5e47f3-95a8-4d1a-905f-10f481c31562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.24.156.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:05:10.000Z",
      "valid_until": "2026-06-14T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T07:04:32.400Z",
      "x_nadsec_last_seen": "2026-05-13T07:10:56.389Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-13T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mysqld; ports=3306; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.59.96.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:05:10.000Z",
      "valid_until": "2026-06-14T07:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-13T06:08:21.614Z",
      "x_nadsec_last_seen": "2026-05-13T06:14:01.207Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-13T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bd6504ca-1f3c-4ef2-852c-4851e7f990ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.146.240.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:05:10.000Z",
      "valid_until": "2026-06-14T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T06:13:57.107Z",
      "x_nadsec_last_seen": "2026-05-13T06:13:57.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-13T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3c65424c-1d34-45bc-9ee9-38114cdfa836",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.225.62.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:05:10.000Z",
      "valid_until": "2026-06-14T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T06:18:58.807Z",
      "x_nadsec_last_seen": "2026-05-13T06:19:03.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-13T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=41148; asn_org=Zolotaya Linia JSC.",
      "id": "indicator--309e6a42-aa99-4c68-8d26-93421f3a6cf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.200.250.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:05:10.000Z",
      "valid_until": "2026-06-14T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T06:12:05.340Z",
      "x_nadsec_last_seen": "2026-05-13T06:16:38.062Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41148"
      ],
      "x_nadsec_orgs": [
        "Zolotaya Linia JSC."
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=137655; asn_org=Angel Air Network Solutions Pvt. Ltd.",
      "id": "indicator--2d0adb7d-a7ec-430d-9e09-4c3932287ae6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.164.198.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T08:45:49.468Z",
      "x_nadsec_last_seen": "2026-05-13T08:45:49.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137655"
      ],
      "x_nadsec_orgs": [
        "Angel Air Network Solutions Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--dcc0c787-3972-496f-99be-8a90d75bb601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.162.70.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T08:39:58.388Z",
      "x_nadsec_last_seen": "2026-05-26T09:26:11.486Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3103; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b76dc45a-522c-4571-9f37-a70f5d448963",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.166.44.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-05-13T08:01:36.050Z",
      "x_nadsec_last_seen": "2026-05-13T08:34:15.062Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=113; services=ftpd; ports=21; cc=VN; asn=135905; asn_org=VIETNAM POSTS AND TELECOMMUNICATIONS GROUP; user(top)=A***n; pass(top)=t**t",
      "id": "indicator--f82786f8-cf7b-461b-81c3-5111339c9286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.225.74.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 905,
      "x_nadsec_first_seen": "2026-05-13T07:14:20.404Z",
      "x_nadsec_last_seen": "2026-05-13T15:11:21.488Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135905"
      ],
      "x_nadsec_orgs": [
        "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "A***n",
        "a***n",
        "a***********r",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "a***n",
        "a******3",
        "a*******s",
        "r**t",
        "t**t"
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T08:07:59.017Z",
      "x_nadsec_last_seen": "2026-05-18T02:50:42.582Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ef22fe47-9961-4c8f-8544-d045d0f5bad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.178.234.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T08:54:37.513Z",
      "x_nadsec_last_seen": "2026-05-13T08:56:43.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CH; asn=51852; asn_org=Private Layer INC; user(top)=r**t",
      "id": "indicator--94602b99-dde6-42eb-8d9e-ea38456a8b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.43.166.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T08:53:23.551Z",
      "x_nadsec_last_seen": "2026-05-13T10:19:28.131Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "51852"
      ],
      "x_nadsec_orgs": [
        "Private Layer INC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--83aa3404-2005-40e6-a5c8-f5f45d1ad1cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.248.189.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T08:07:47.430Z",
      "x_nadsec_last_seen": "2026-05-13T08:09:52.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=SG; asn=9009; asn_org=M247 Europe SRL; user(top)=r**t",
      "id": "indicator--b99cbdd8-c02f-4f06-9154-f986153902f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.200.116.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T08:25:00.372Z",
      "x_nadsec_last_seen": "2026-05-13T08:25:00.372Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=42765; asn_org=Excellent Signalman LLC",
      "id": "indicator--56172a8c-f5cd-4b6d-9773-31d7d56f50c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.108.214.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-13T08:49:23.604Z",
      "x_nadsec_last_seen": "2026-05-28T17:10:52.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42765"
      ],
      "x_nadsec_orgs": [
        "Excellent Signalman LLC"
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7201f965-c55a-4ccb-a0ee-5d33fe7c9240",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T08:46:20.880Z",
      "x_nadsec_last_seen": "2026-05-13T08:46:20.880Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-13T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=30936; asn_org=RENET COM Ltd.",
      "id": "indicator--5cf8cc77-df47-4551-b279-f7ccab180e16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.116.49.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:05:10.000Z",
      "valid_until": "2026-06-14T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T08:35:54.058Z",
      "x_nadsec_last_seen": "2026-05-13T08:38:00.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "30936"
      ],
      "x_nadsec_orgs": [
        "RENET COM Ltd."
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=58898; asn_org=Rainbow communications India Pvt Ltd",
      "id": "indicator--71d53e3f-f46a-498c-9520-aacdb6c97f00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.125.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T10:22:41.039Z",
      "x_nadsec_last_seen": "2026-05-13T10:29:58.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58898"
      ],
      "x_nadsec_orgs": [
        "Rainbow communications India Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=134863; asn_org=SP INTERNET TECHNOLOGIES PRIVATE LTD",
      "id": "indicator--abe28c0f-2399-4c25-bba1-a9427e6dcbb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.237.59.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-13T10:25:03.696Z",
      "x_nadsec_last_seen": "2026-05-25T15:15:05.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134863"
      ],
      "x_nadsec_orgs": [
        "SP INTERNET TECHNOLOGIES PRIVATE LTD"
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--014d826e-cee2-4a9f-be5c-708bec4469c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.136.66.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T10:34:07.721Z",
      "x_nadsec_last_seen": "2026-05-13T10:36:13.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--c6cbb247-dd37-483f-a8b9-463a8ea737f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T11:00:02.802Z",
      "x_nadsec_last_seen": "2026-05-13T11:00:02.802Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--619eb32f-26e0-4e34-a2ae-1b4853ed657f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.54.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T10:32:30.838Z",
      "x_nadsec_last_seen": "2026-05-13T10:34:38.525Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b9e6416b-7984-4389-baca-d0b564e5bdd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.85.110.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T10:19:52.468Z",
      "x_nadsec_last_seen": "2026-05-13T10:19:52.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--95df801d-5bf6-4a2d-9c6c-c67c3eeac5df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.96.105.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T10:38:52.756Z",
      "x_nadsec_last_seen": "2026-05-13T10:45:47.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3b0a6a84-e570-4fd5-84a4-b7006a1aee0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T10:50:42.601Z",
      "x_nadsec_last_seen": "2026-05-23T19:31:34.922Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-13T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=35699; asn_org=Adamo Telecom Iberia S.A.",
      "id": "indicator--1d57aebf-5a5d-4dc4-aaa1-6b62fa2a728b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.126.40.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:05:10.000Z",
      "valid_until": "2026-06-14T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T10:24:51.317Z",
      "x_nadsec_last_seen": "2026-05-13T10:26:58.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "35699"
      ],
      "x_nadsec_orgs": [
        "Adamo Telecom Iberia S.A."
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133711; asn_org=Home Broadband Services LLP",
      "id": "indicator--ad47ddcd-ef88-425f-905e-79c31925b83f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.47.17.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T11:41:48.530Z",
      "x_nadsec_last_seen": "2026-05-13T11:43:54.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133711"
      ],
      "x_nadsec_orgs": [
        "Home Broadband Services LLP"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--14c48c52-d52d-484b-b09b-bf2439085a84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.97.191.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T11:16:59.527Z",
      "x_nadsec_last_seen": "2026-05-13T11:16:59.527Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--ad1e8d8b-4fe4-412b-9eb1-c7f215dae840",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.212.120.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T11:17:04.560Z",
      "x_nadsec_last_seen": "2026-05-13T11:17:04.560Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--a28e6ccc-08a6-4142-9cc7-80e853b9af72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.29.84.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T11:16:56.821Z",
      "x_nadsec_last_seen": "2026-05-13T11:16:56.821Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--166a3289-cb60-4130-88d9-201a00a7e0c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.22.97.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T11:27:13.487Z",
      "x_nadsec_last_seen": "2026-05-13T11:29:18.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--863928e1-2d63-470d-855c-11dd469b0ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.235.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T11:20:00.833Z",
      "x_nadsec_last_seen": "2026-05-13T11:20:00.833Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--619b3424-58b2-4fdd-96c6-e5b6f7ef1388",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.8.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T11:44:40.593Z",
      "x_nadsec_last_seen": "2026-05-13T11:51:01.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--95e22142-bfe0-42b7-aab5-148d0b5ea825",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.240.59.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T11:34:46.723Z",
      "x_nadsec_last_seen": "2026-05-13T11:34:46.723Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c047002f-67c7-4d2e-81c6-fa684f0c5dd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T11:30:30.927Z",
      "x_nadsec_last_seen": "2026-05-13T11:30:41.250Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--1b9a4185-1dc5-473a-a149-e0e133659d5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.48.38.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T11:16:48.846Z",
      "x_nadsec_last_seen": "2026-05-13T11:16:48.846Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--ffff3f1d-b2e3-4c17-89ef-b28fb9577851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.84.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T12:02:49.278Z",
      "x_nadsec_last_seen": "2026-05-13T12:03:12.962Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.21.227.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T11:34:10.229Z",
      "x_nadsec_last_seen": "2026-05-22T02:49:56.216Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-13T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=25369; asn_org=Hydra Communications Ltd",
      "id": "indicator--0aa42c6e-4291-49bd-b6ae-5255f9f47dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '69.5.169.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:05:10.000Z",
      "valid_until": "2026-06-14T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T11:34:44.919Z",
      "x_nadsec_last_seen": "2026-05-28T16:10:16.295Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "25369"
      ],
      "x_nadsec_orgs": [
        "Hydra Communications Ltd"
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4216f86f-e279-432e-aad1-d68537c0eee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.32.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T12:08:29.399Z",
      "x_nadsec_last_seen": "2026-05-13T12:15:16.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-13T12:31:37.248Z",
      "x_nadsec_last_seen": "2026-05-13T12:32:55.258Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--2082d875-6236-4153-9cd9-2504eaf0f09f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T12:31:44.224Z",
      "x_nadsec_last_seen": "2026-05-13T12:32:39.572Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--c2b3a7c6-fd16-4e88-9757-8007df60d118",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T12:32:24.262Z",
      "x_nadsec_last_seen": "2026-05-13T12:32:24.262Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--9d2f3eb3-6444-4799-ba3a-9590a246a4eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.251.246.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-13T13:01:20.804Z",
      "x_nadsec_last_seen": "2026-05-31T11:33:10.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--ffc4d498-4260-4ff5-a2fd-ca8714813967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.170.189.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T12:49:23.641Z",
      "x_nadsec_last_seen": "2026-05-13T12:49:24.464Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--97c85238-6552-4526-b5ba-3fbc1e38181b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.124.104.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T12:56:30.939Z",
      "x_nadsec_last_seen": "2026-05-13T13:03:26.510Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45804; asn_org=MEGHBELA BROADBAND",
      "id": "indicator--f9bb3408-fbf6-4d79-a449-23f4ecd2679d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.29.202.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-13T12:43:13.767Z",
      "x_nadsec_last_seen": "2026-05-25T13:54:22.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45804"
      ],
      "x_nadsec_orgs": [
        "MEGHBELA BROADBAND"
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SA; asn=35753; asn_org=Etihad Salam Telecom CJSC; user(top)=**",
      "id": "indicator--b7ea1b11-c5bf-4c1a-8d71-aae9bbd20d80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.24.144.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T12:30:12.365Z",
      "x_nadsec_last_seen": "2026-05-13T12:30:12.365Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35753"
      ],
      "x_nadsec_orgs": [
        "Etihad Salam Telecom CJSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mysqld; ports=3306; cc=BG; asn=209896; asn_org=Contrust Solutions S.R.L.",
      "id": "indicator--77f6999a-dbd2-4b69-83c1-5145fcc5fba6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.152.221.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 1282,
      "x_nadsec_first_seen": "2026-05-13T12:11:30.783Z",
      "x_nadsec_last_seen": "2026-05-15T00:40:47.577Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "209896"
      ],
      "x_nadsec_orgs": [
        "Contrust Solutions S.R.L."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "a***n",
        "a***********r",
        "d*****n",
        "m***l"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=25; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--8ac35389-5642-4fa8-8c1b-940b0455d971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.104.113.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T13:05:11.000Z",
      "valid_until": "2026-06-14T13:05:08.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-05-13T12:31:45.318Z",
      "x_nadsec_last_seen": "2026-05-13T12:36:34.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--21198a9b-8615-4ec1-9391-ca22ca3a6250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.232.27.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T13:55:32.307Z",
      "x_nadsec_last_seen": "2026-05-13T13:57:37.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1fdf7c5c-afe7-4512-9f0a-d0a1335e56b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.161.192.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T13:55:58.590Z",
      "x_nadsec_last_seen": "2026-05-13T14:02:41.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=24812; asn_org=RPC HomeNet Ltd.",
      "id": "indicator--d7f841a1-9c3d-4b8b-b2fb-485e8f2e6319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.105.206.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-13T13:44:47.097Z",
      "x_nadsec_last_seen": "2026-05-14T10:33:27.542Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "24812"
      ],
      "x_nadsec_orgs": [
        "RPC HomeNet Ltd."
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--3a395ffb-c356-4224-8340-fc12027cb42f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T13:27:55.020Z",
      "x_nadsec_last_seen": "2026-05-13T13:30:02.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--39c26929-bb42-4ef2-8dbd-8ba871f6cfdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T14:04:33.256Z",
      "x_nadsec_last_seen": "2026-05-13T14:04:33.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=21267; asn_org=Wavenet Limited",
      "id": "indicator--c9903361-8070-4aad-81a1-912b130c7bb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.26.44.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T13:28:56.541Z",
      "x_nadsec_last_seen": "2026-05-13T13:31:02.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "21267"
      ],
      "x_nadsec_orgs": [
        "Wavenet Limited"
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dc096fd5-9806-4b7b-a787-e30ca1f8561b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.153.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T13:25:39.989Z",
      "x_nadsec_last_seen": "2026-05-13T13:25:50.163Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a9760136-9543-40a6-9398-99f6fb34a8f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.53.171.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T13:09:17.839Z",
      "x_nadsec_last_seen": "2026-05-13T13:09:17.839Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--ed2d26d0-8e62-4375-a2cb-a8db03ec57aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.183.140.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T13:06:19.345Z",
      "x_nadsec_last_seen": "2026-05-13T13:08:24.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-13T14:07:43.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--4dc0e723-bb5c-49cb-a694-36c21ce3fc58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T14:07:43.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T14:07:43.000Z",
      "valid_until": "2026-06-14T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T13:33:02.068Z",
      "x_nadsec_last_seen": "2026-05-13T13:42:26.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=15868; asn_org=Nalchik-Telecom Ltd",
      "id": "indicator--15448d68-5c30-4a1d-bf0f-d7df52302793",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.248.220.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T15:58:31.949Z",
      "x_nadsec_last_seen": "2026-05-13T16:00:52.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "15868"
      ],
      "x_nadsec_orgs": [
        "Nalchik-Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=17421; asn_org=Mobile Business Group",
      "id": "indicator--5b1b5a17-7cc0-4555-ad66-86a1c9bc8677",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.83.19.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T16:04:28.237Z",
      "x_nadsec_last_seen": "2026-05-13T16:11:27.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "17421"
      ],
      "x_nadsec_orgs": [
        "Mobile Business Group"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.1.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T15:05:17.738Z",
      "x_nadsec_last_seen": "2026-05-23T19:29:27.488Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--da6b8046-f73b-4f6c-8826-e955373a4b4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.214.123.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T15:40:58.621Z",
      "x_nadsec_last_seen": "2026-05-13T15:43:06.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--ac687227-7272-478c-bf2e-09763b30a0df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.251.105.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T15:31:03.280Z",
      "x_nadsec_last_seen": "2026-05-13T15:33:09.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--d85e305f-3b88-44f2-8157-a52d7a7e7d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.112.132.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T15:52:10.494Z",
      "x_nadsec_last_seen": "2026-05-13T15:54:17.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--143797c8-40b0-466f-82cd-e90a2e1e746c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.217.203.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T15:22:48.301Z",
      "x_nadsec_last_seen": "2026-05-13T15:24:55.064Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--d6a8a2da-344f-4a4c-bc57-783c99bbca73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.106.128.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T15:53:17.769Z",
      "x_nadsec_last_seen": "2026-05-13T15:55:25.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-13T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--190c2be7-d23c-4a8a-901d-fadfc0e560b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.103.36.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:05:10.000Z",
      "valid_until": "2026-06-14T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T15:17:55.405Z",
      "x_nadsec_last_seen": "2026-05-13T15:18:35.533Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--52794779-17cb-484a-9290-22119465b1f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.24.17.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T17:54:45.788Z",
      "x_nadsec_last_seen": "2026-05-13T17:55:10.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-05-13T16:20:44.112Z",
      "x_nadsec_last_seen": "2026-05-13T19:22:17.853Z",
      "x_nadsec_ports": [
        "42",
        "1723",
        "1883",
        "21",
        "81",
        "135",
        "445",
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mqttd",
        "pptpd",
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--cf4c60e7-2917-4dfb-aa46-2806cf64384c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.138.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T17:53:48.121Z",
      "x_nadsec_last_seen": "2026-05-13T17:54:17.548Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--1ed169d2-b42a-4d4b-9615-c56708d49679",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T17:41:46.725Z",
      "x_nadsec_last_seen": "2026-05-13T17:41:46.725Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--48bb4e69-ff25-46a6-8145-3379faefbec9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.189.159.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-13T17:51:44.955Z",
      "x_nadsec_last_seen": "2026-05-31T17:25:31.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--b4f015fc-a263-4bd4-8c76-4521f62c7769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.205.250.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T17:52:54.262Z",
      "x_nadsec_last_seen": "2026-05-13T17:52:54.389Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CA; asn=19523; asn_org=FlexNetworks",
      "id": "indicator--bd4fbce6-9e10-4aae-9e86-bc7f87965d1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.203.89.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T17:40:25.076Z",
      "x_nadsec_last_seen": "2026-05-13T17:47:05.225Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "19523"
      ],
      "x_nadsec_orgs": [
        "FlexNetworks"
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T17:31:22.799Z",
      "x_nadsec_last_seen": "2026-05-21T19:33:57.243Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-13T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--d3bbd81b-8093-46bc-9212-8a0de5d0db01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.90.84.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:05:17.000Z",
      "valid_until": "2026-06-14T18:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-13T17:59:02.274Z",
      "x_nadsec_last_seen": "2026-05-31T13:32:13.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b7c731da-da6e-4aeb-97cb-f93f8a5adfc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.10.184.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T18:51:50.438Z",
      "x_nadsec_last_seen": "2026-05-13T18:51:54.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=37100; asn_org=SEACOM-AS",
      "id": "indicator--b1142d21-fbcd-446b-87e1-e80c7f352abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.30.51.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T18:22:11.760Z",
      "x_nadsec_last_seen": "2026-05-19T09:34:18.961Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37100"
      ],
      "x_nadsec_orgs": [
        "SEACOM-AS"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=152296; asn_org=Wind Waves Broadband Private Limited",
      "id": "indicator--b55f7809-ce73-4d05-b5de-c41d346bc5aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.10.30.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T18:24:31.950Z",
      "x_nadsec_last_seen": "2026-05-13T18:24:32.022Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "152296"
      ],
      "x_nadsec_orgs": [
        "Wind Waves Broadband Private Limited"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4871d36e-a8c7-4ed7-aa87-f17f7e7c4a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T18:40:36.466Z",
      "x_nadsec_last_seen": "2026-05-13T18:40:56.455Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--cde53982-e31e-4cad-bba1-e71b24a2a744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.32.238.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T18:31:58.815Z",
      "x_nadsec_last_seen": "2026-05-13T18:31:58.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a195f2d3-78f3-446a-9308-eea7d514635d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T19:01:30.820Z",
      "x_nadsec_last_seen": "2026-05-13T19:01:40.981Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=11232; asn_org=Midcontinent Communications",
      "id": "indicator--622683ea-2cc3-4923-ae7c-6f598c51c7a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.220.59.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-13T19:03:53.991Z",
      "x_nadsec_last_seen": "2026-05-25T15:28:38.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11232"
      ],
      "x_nadsec_orgs": [
        "Midcontinent Communications"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--000e7147-b14d-46bc-b6c4-dc91a4511b64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T18:32:46.881Z",
      "x_nadsec_last_seen": "2026-05-13T18:32:46.881Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--30dc4a52-f414-44ce-8271-dc248942350d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T18:33:13.837Z",
      "x_nadsec_last_seen": "2026-05-13T18:33:13.837Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--52302fa1-78b1-4965-a8bc-79c150a4462d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T18:32:46.615Z",
      "x_nadsec_last_seen": "2026-05-13T18:32:46.615Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T19:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6b6cf599-2368-49d6-a6a8-96d2f7d9723a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T19:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:05:09.000Z",
      "valid_until": "2026-06-14T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T18:33:14.032Z",
      "x_nadsec_last_seen": "2026-05-13T18:33:14.032Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--ac292700-c845-480b-b1d0-803a17f23c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.238.227.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:05:10.000Z",
      "valid_until": "2026-06-14T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T19:19:03.939Z",
      "x_nadsec_last_seen": "2026-05-13T19:21:09.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-13T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2189844c-a6b4-48cd-bddf-d32ae1f43109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:05:10.000Z",
      "valid_until": "2026-06-14T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T19:39:17.508Z",
      "x_nadsec_last_seen": "2026-05-13T19:39:17.508Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=49889; asn_org=Crystal Telecom Ltd",
      "id": "indicator--dd278c73-4207-4b8e-a3b6-1ebdf49e1c33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.98.20.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:05:10.000Z",
      "valid_until": "2026-06-14T20:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-13T19:35:27.242Z",
      "x_nadsec_last_seen": "2026-05-31T15:18:24.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "49889"
      ],
      "x_nadsec_orgs": [
        "Crystal Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-13T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--96b96327-5f6a-4a0b-80e8-b32bb0877c49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.103.157.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:05:10.000Z",
      "valid_until": "2026-06-14T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T19:05:47.019Z",
      "x_nadsec_last_seen": "2026-05-13T19:06:13.823Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--6140bff3-2c78-4e32-a9c9-aed4e7a85c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.82.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T20:31:00.204Z",
      "x_nadsec_last_seen": "2026-05-13T20:31:00.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--d4fefa21-faae-46d9-9115-a5012f8f9247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.77.222.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-13T20:19:40.874Z",
      "x_nadsec_last_seen": "2026-05-13T20:22:38.149Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--086555f0-c1b3-45b1-80ae-f334d5eefb0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T20:08:34.256Z",
      "x_nadsec_last_seen": "2026-05-13T20:08:34.256Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--45ede1d3-6188-43f1-9b7a-ebc2eaf33b52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T20:37:38.625Z",
      "x_nadsec_last_seen": "2026-05-18T22:30:46.667Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f83fb566-c2b8-4f96-96b4-9e48c778f6e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.109.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-13T21:02:04.132Z",
      "x_nadsec_last_seen": "2026-05-13T21:02:47.724Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--6ea87418-cb8f-443c-af06-c9ba93010e0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.105.200.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-13T20:25:29.039Z",
      "x_nadsec_last_seen": "2026-05-13T21:05:18.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=39353; asn_org=Gobierno del Principado de Asturias",
      "id": "indicator--444f4b35-58f2-4418-a8c5-84cf8bf2e643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.151.19.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-13T20:26:51.748Z",
      "x_nadsec_last_seen": "2026-05-22T16:40:27.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "39353"
      ],
      "x_nadsec_orgs": [
        "Gobierno del Principado de Asturias"
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3be54320-196b-4a51-8b18-148395f02002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T20:25:12.773Z",
      "x_nadsec_last_seen": "2026-05-13T20:25:12.773Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--117ee56d-c4ea-4616-972a-a295ce22aa29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:05:10.000Z",
      "valid_until": "2026-06-14T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T20:25:23.607Z",
      "x_nadsec_last_seen": "2026-05-13T20:25:23.607Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-13T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--730e965c-374e-42c1-a0cd-211be8980f46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.51.109.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:05:13.000Z",
      "valid_until": "2026-06-14T22:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T21:37:02.602Z",
      "x_nadsec_last_seen": "2026-05-13T21:37:09.579Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ],
      "x_nadsec_usernames_attempted": [
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-05-13T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--d9db45fd-6799-4473-802e-aff1f3aa7ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.31.48.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:05:13.000Z",
      "valid_until": "2026-06-14T22:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T21:43:03.717Z",
      "x_nadsec_last_seen": "2026-05-16T05:18:53.154Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:05:13.000Z",
      "valid_until": "2026-06-14T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T22:03:48.509Z",
      "x_nadsec_last_seen": "2026-05-13T22:03:48.509Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-13T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.29.49.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:05:13.000Z",
      "valid_until": "2026-06-14T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T21:57:11.925Z",
      "x_nadsec_last_seen": "2026-05-13T21:57:11.925Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-13T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=KR; asn=4766; asn_org=Korea Telecom; user(top)=**",
      "id": "indicator--15ebedc5-67bf-483a-b9fe-b132d32f7ebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.147.200.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:05:13.000Z",
      "valid_until": "2026-06-14T22:05:08.000Z",
      "x_nadsec_event_count": 50,
      "x_nadsec_first_seen": "2026-05-13T21:30:08.741Z",
      "x_nadsec_last_seen": "2026-05-14T00:34:28.327Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-13T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--84cded69-a10e-4fdd-ba75-8f90fddefc22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.99.38.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T22:05:13.000Z",
      "valid_until": "2026-06-14T22:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T21:32:02.810Z",
      "x_nadsec_last_seen": "2026-05-13T21:34:09.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--21cbf263-b6bd-48e9-a94e-5d048949bb40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.144.175.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T22:58:42.702Z",
      "x_nadsec_last_seen": "2026-05-13T22:58:42.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BD; asn=9441; asn_org=Next Online Limited.",
      "id": "indicator--03bb5522-b309-48a6-bdbc-3df28930a313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.245.205.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T22:16:46.666Z",
      "x_nadsec_last_seen": "2026-05-13T22:16:48.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "9441"
      ],
      "x_nadsec_orgs": [
        "Next Online Limited."
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=203971; asn_org=AzFiberNet LLC",
      "id": "indicator--71cfa409-d1c5-4455-a7e1-2dc5afe8bbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.118.51.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T22:26:26.292Z",
      "x_nadsec_last_seen": "2026-05-13T22:28:32.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "203971"
      ],
      "x_nadsec_orgs": [
        "AzFiberNet LLC"
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=39442; asn_org=JSC RDE Unico",
      "id": "indicator--378bbf40-2daa-4961-8bd5-a5bae6f98684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.149.188.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T22:12:14.219Z",
      "x_nadsec_last_seen": "2026-05-13T22:12:14.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39442"
      ],
      "x_nadsec_orgs": [
        "JSC RDE Unico"
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--40bd01e0-afa7-42de-ad06-fdc26292a817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.33.199.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T22:45:32.651Z",
      "x_nadsec_last_seen": "2026-05-13T22:47:47.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--3666ab20-1b56-4d7c-a579-4e23a7617c3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.5.16.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T22:56:37.762Z",
      "x_nadsec_last_seen": "2026-05-13T22:58:41.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--13e4a5e9-83c3-4036-8200-64148e577f8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T22:08:58.141Z",
      "x_nadsec_last_seen": "2026-05-13T22:08:58.141Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--dac13386-c266-43d5-9bd5-0502d7c514e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T22:40:07.994Z",
      "x_nadsec_last_seen": "2026-05-13T22:40:07.994Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-13T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=BG; asn=48090; asn_org=Techoff Srv Limited",
      "id": "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-13T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.123.109.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:05:10.000Z",
      "valid_until": "2026-06-14T23:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-13T22:46:20.461Z",
      "x_nadsec_last_seen": "2026-05-14T02:24:32.270Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "48090"
      ],
      "x_nadsec_orgs": [
        "Techoff Srv Limited"
      ]
    },
    {
      "created": "2026-05-14T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--e661c93f-98be-4d34-8e34-4c20f3f9e1f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.111.202.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:05:04.000Z",
      "valid_until": "2026-06-15T00:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T23:21:15.917Z",
      "x_nadsec_last_seen": "2026-05-13T23:21:16.772Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c6d78f9e-948c-4514-a058-90a9f0dbc41e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.65.181.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:05:04.000Z",
      "valid_until": "2026-06-15T00:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-13T23:22:16.278Z",
      "x_nadsec_last_seen": "2026-05-14T00:22:50.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-14T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--fa8f0d6c-eb96-4f50-8ebc-bcaf8271fd0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.113.145.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:05:04.000Z",
      "valid_until": "2026-06-15T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-13T23:14:00.970Z",
      "x_nadsec_last_seen": "2026-05-13T23:14:06.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-14T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=39487; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--653977e4-4221-4e55-9ce5-a337fa97c5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:05:04.000Z",
      "valid_until": "2026-06-15T00:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-13T23:07:16.152Z",
      "x_nadsec_last_seen": "2026-05-13T23:07:16.155Z",
      "x_nadsec_ports": [
        "42",
        "39487"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-14T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--a73cf790-bfa3-422c-8487-75bbbfa8b027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:05:04.000Z",
      "valid_until": "2026-06-15T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T23:05:41.530Z",
      "x_nadsec_last_seen": "2026-05-13T23:05:41.530Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-14T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--3e9090ce-d29d-4cb0-ab58-8e8a2d8d2fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:05:04.000Z",
      "valid_until": "2026-06-15T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T23:11:20.656Z",
      "x_nadsec_last_seen": "2026-05-13T23:11:20.656Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-14T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--5ec78a7c-b309-4aec-a23c-835b6375d278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T00:05:04.000Z",
      "valid_until": "2026-06-15T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-13T23:21:10.567Z",
      "x_nadsec_last_seen": "2026-05-13T23:21:10.567Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-14T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e1f50bd0-89a7-46df-8a76-6e7b07e0af3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.66.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:05:04.000Z",
      "valid_until": "2026-06-15T01:05:03.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-14T00:26:22.238Z",
      "x_nadsec_last_seen": "2026-05-14T00:29:11.258Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-14T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--2ef6fb13-b474-438b-b19c-d689c381ef05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.157.156.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:05:04.000Z",
      "valid_until": "2026-06-15T01:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T00:14:38.327Z",
      "x_nadsec_last_seen": "2026-05-14T08:04:02.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-14T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--3f554858-5eda-4f84-82d3-e170a9645f74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.48.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:05:04.000Z",
      "valid_until": "2026-06-15T01:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T00:53:14.157Z",
      "x_nadsec_last_seen": "2026-05-14T00:53:14.157Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-14T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--2b0650eb-2606-4157-8118-5676e989b32f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.255.50.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:05:04.000Z",
      "valid_until": "2026-06-15T01:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T01:04:27.261Z",
      "x_nadsec_last_seen": "2026-05-14T01:04:27.261Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--be49b12d-7133-4956-a884-653aaf73c7d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.53.36.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T01:41:56.104Z",
      "x_nadsec_last_seen": "2026-05-14T01:48:51.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--f6564a2d-ea4b-4053-8c2d-326f71e093a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.219.65.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T01:32:35.838Z",
      "x_nadsec_last_seen": "2026-05-14T01:39:58.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--c68bd87b-c41a-4dfe-b0d7-6731635a2a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.245.61.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T01:37:05.788Z",
      "x_nadsec_last_seen": "2026-05-14T01:39:10.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--0478d659-b405-4db0-8557-ac0f3076fc44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.221.207.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T01:38:39.257Z",
      "x_nadsec_last_seen": "2026-05-14T01:46:46.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56047; asn_org=China Mobile communications corporation",
      "id": "indicator--a8019624-12ef-4b4c-b14a-53f6ba0a958c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.215.215.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T01:59:03.348Z",
      "x_nadsec_last_seen": "2026-05-14T01:59:08.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56047"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--510e63d8-8cf0-45eb-9c18-4f91d885e962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.141.143.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T01:58:29.253Z",
      "x_nadsec_last_seen": "2026-05-14T02:00:34.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d0246f33-282a-4fa7-99c7-74937d9c1162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.14.79.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T01:23:44.489Z",
      "x_nadsec_last_seen": "2026-05-14T01:23:44.489Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5e9026ac-323e-4325-8685-c5d88079c34f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.177.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-13T09:55:49.900Z",
      "x_nadsec_last_seen": "2026-05-30T06:29:58.326Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--7f80473c-6fd5-4c7e-b940-2de7c1725a72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.237.205.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T01:08:00.453Z",
      "x_nadsec_last_seen": "2026-05-14T01:08:00.453Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-14T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU",
      "id": "indicator--8e4019a6-d877-4d56-b0ea-4976f8c8194a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.91.118.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:05:12.000Z",
      "valid_until": "2026-06-15T02:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T01:56:20.743Z",
      "x_nadsec_last_seen": "2026-05-14T01:56:36.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ]
    },
    {
      "created": "2026-05-14T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=327693; asn_org=ECHO-SP",
      "id": "indicator--23e596c0-3ff5-413e-a1df-eebc2dfc223d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.67.178.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:05:06.000Z",
      "valid_until": "2026-06-15T03:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T02:28:39.587Z",
      "x_nadsec_last_seen": "2026-05-14T02:29:48.257Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327693"
      ],
      "x_nadsec_orgs": [
        "ECHO-SP"
      ]
    },
    {
      "created": "2026-05-14T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--05b39e40-8647-444c-b926-b58e9c60adec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.69.37.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:05:06.000Z",
      "valid_until": "2026-06-15T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T02:12:30.392Z",
      "x_nadsec_last_seen": "2026-05-14T02:14:36.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-14T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--12f366f5-3a5f-40af-8c66-3fcadbcc9e6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.185.192.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:05:06.000Z",
      "valid_until": "2026-06-15T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T02:40:36.482Z",
      "x_nadsec_last_seen": "2026-05-14T02:42:41.498Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-14T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2505c337-3453-4988-bfd3-93161d78175d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:05:06.000Z",
      "valid_until": "2026-06-15T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T02:58:26.137Z",
      "x_nadsec_last_seen": "2026-05-14T02:58:26.137Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-14T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a1527cd0-6984-464f-8d4f-f06e265f7331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.198.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:05:10.000Z",
      "valid_until": "2026-06-15T04:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T03:44:57.402Z",
      "x_nadsec_last_seen": "2026-05-28T03:14:40.108Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-14T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--46c98a12-87f6-4776-88b2-35cdf39e87c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.187.17.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:05:10.000Z",
      "valid_until": "2026-06-15T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T03:16:08.504Z",
      "x_nadsec_last_seen": "2026-05-14T03:18:13.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-14T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=24164; asn_org=UNION BROADBAND NETWORK",
      "id": "indicator--74d926aa-a23a-4a55-ad0f-6f87cf8ee3d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.218.220.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:05:10.000Z",
      "valid_until": "2026-06-15T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T03:46:01.188Z",
      "x_nadsec_last_seen": "2026-05-14T03:48:06.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "24164"
      ],
      "x_nadsec_orgs": [
        "UNION BROADBAND NETWORK"
      ]
    },
    {
      "created": "2026-05-14T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--f88975e6-069d-4eeb-b061-b05155ceb8eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.98.232.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:05:10.000Z",
      "valid_until": "2026-06-15T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T03:48:39.818Z",
      "x_nadsec_last_seen": "2026-05-14T03:48:39.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-14T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--91b4169c-b4d7-4b47-a7c8-38f54f1d3002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.244.69.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:05:10.000Z",
      "valid_until": "2026-06-15T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T03:52:43.517Z",
      "x_nadsec_last_seen": "2026-05-14T03:54:49.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-05-14T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--c6a2955a-fe29-4d23-8331-c9d87b6ffd3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.229.122.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:05:10.000Z",
      "valid_until": "2026-06-15T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T05:02:45.431Z",
      "x_nadsec_last_seen": "2026-05-14T05:04:52.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-14T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c43d9a26-9aa0-424e-9d5a-af9e4160d1a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:05:10.000Z",
      "valid_until": "2026-06-15T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T04:11:53.532Z",
      "x_nadsec_last_seen": "2026-05-14T04:11:53.532Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-14T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DO; asn=28118; asn_org=ALTICE DOMINICANA S.A.",
      "id": "indicator--8fabe323-8a1e-4141-917c-e17dbac50c08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.167.106.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:05:10.000Z",
      "valid_until": "2026-06-15T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T04:09:44.051Z",
      "x_nadsec_last_seen": "2026-05-14T04:09:50.432Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "28118"
      ],
      "x_nadsec_orgs": [
        "ALTICE DOMINICANA S.A."
      ]
    },
    {
      "created": "2026-05-14T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--8427779d-1eb7-4899-ac6f-41789850362c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.115.192.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:05:10.000Z",
      "valid_until": "2026-06-15T05:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T05:03:34.282Z",
      "x_nadsec_last_seen": "2026-05-31T22:24:48.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-14T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6584f493-9567-4fe0-87fb-b290579cb8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:05:10.000Z",
      "valid_until": "2026-06-15T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T04:37:27.488Z",
      "x_nadsec_last_seen": "2026-05-14T04:37:28.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-14T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=270; services=smbd; ports=445; cc=PK; asn=58895; asn_org=Ebone Network PVT. Limited",
      "id": "indicator--e75356bb-b84f-4162-94b4-c534814cf603",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.231.61.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:05:10.000Z",
      "valid_until": "2026-06-15T05:05:09.000Z",
      "x_nadsec_event_count": 270,
      "x_nadsec_first_seen": "2026-05-14T04:50:12.126Z",
      "x_nadsec_last_seen": "2026-05-14T05:04:37.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "58895"
      ],
      "x_nadsec_orgs": [
        "Ebone Network PVT. Limited"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--a97d6d29-075f-4463-a2f9-6e804ea1602a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.29.110.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T06:02:53.642Z",
      "x_nadsec_last_seen": "2026-05-14T06:09:23.991Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=45588; asn_org=Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In",
      "id": "indicator--c51e5bd6-8f85-48a3-ba80-13d07c64da90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.130.159.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T05:12:08.136Z",
      "x_nadsec_last_seen": "2026-05-14T05:14:14.542Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45588"
      ],
      "x_nadsec_orgs": [
        "Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8ef6d3fa-2a97-4a60-92d6-d7e895b59b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.25.85.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T06:00:37.467Z",
      "x_nadsec_last_seen": "2026-05-14T06:02:42.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--efe8887a-c482-4578-ab7f-25fda09467d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.113.224.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-14T05:50:06.143Z",
      "x_nadsec_last_seen": "2026-05-30T05:57:47.948Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--9e6c9324-d9e7-4ce3-8aac-74bb2044cdbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.218.224.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T05:20:46.968Z",
      "x_nadsec_last_seen": "2026-05-14T05:29:02.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4cabb1a2-67ea-4bdc-9c84-09a4c552f09e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.38.33.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T05:51:55.704Z",
      "x_nadsec_last_seen": "2026-05-14T05:52:05.880Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=16629; asn_org=CTC. CORP S.A. TELEFONICA EMPRESAS",
      "id": "indicator--10669b83-ec11-4068-af6b-bca494f21f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.54.102.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-05-14T05:33:32.820Z",
      "x_nadsec_last_seen": "2026-05-19T15:11:26.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "16629"
      ],
      "x_nadsec_orgs": [
        "CTC. CORP S.A. TELEFONICA EMPRESAS"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--ed5039ae-0e06-42c0-89db-43079fa374b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.88.205.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T05:32:31.157Z",
      "x_nadsec_last_seen": "2026-05-14T05:39:12.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--7df524f7-ba52-4ea8-8553-3c0d01adec0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.175.97.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T05:59:44.967Z",
      "x_nadsec_last_seen": "2026-05-14T06:01:22.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-14T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b88b2fd2-df33-4035-a7b6-0687894d8321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:05:10.000Z",
      "valid_until": "2026-06-15T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T05:58:33.634Z",
      "x_nadsec_last_seen": "2026-05-14T05:58:33.634Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133255; asn_org=Elxer Communications Private Limited",
      "id": "indicator--9978f2b6-fb0a-486e-85af-2b01850cccb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.137.174.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T06:27:36.040Z",
      "x_nadsec_last_seen": "2026-05-14T06:33:09.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133255"
      ],
      "x_nadsec_orgs": [
        "Elxer Communications Private Limited"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.; user(top)=**",
      "id": "indicator--1b1c8bd9-03ce-456d-a2c6-165551ed76bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.31.82.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T06:09:12.333Z",
      "x_nadsec_last_seen": "2026-05-14T06:09:12.333Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--dc2e98c8-4ebc-4b05-ac08-5ef8f4b7a96a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.202.52.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T06:41:33.380Z",
      "x_nadsec_last_seen": "2026-05-14T06:43:38.478Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--25013dac-3b1d-4386-8509-345d0379c59b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.203.114.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T06:47:43.551Z",
      "x_nadsec_last_seen": "2026-05-14T06:49:50.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c5d1b75c-c5fb-4ce0-bf8c-bb398b64f1ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.242.236.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T06:12:15.218Z",
      "x_nadsec_last_seen": "2026-05-14T06:17:30.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--ed0e164b-88d1-4f60-b1ce-6586159123bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.75.132.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T06:15:30.741Z",
      "x_nadsec_last_seen": "2026-05-14T06:17:37.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8772296a-bb9d-4053-90c7-94820e749fa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T07:00:07.694Z",
      "x_nadsec_last_seen": "2026-05-31T02:56:35.124Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--1e7a175c-35a2-466c-b520-27e7ef2abd0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.124.83.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T06:43:57.122Z",
      "x_nadsec_last_seen": "2026-05-14T06:46:02.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-14T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f685ef7a-f831-4a0e-8a96-780498243687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.146.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T07:05:10.000Z",
      "valid_until": "2026-06-15T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T06:51:53.927Z",
      "x_nadsec_last_seen": "2026-05-14T06:51:53.927Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--fec098b2-9289-440a-97f0-96709e4761c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.236.74.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T07:05:39.042Z",
      "x_nadsec_last_seen": "2026-05-14T07:07:44.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37282; asn_org=MAINONE",
      "id": "indicator--e014213e-7d4c-4888-9042-925f5bcdadfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.113.17.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T07:11:18.634Z",
      "x_nadsec_last_seen": "2026-05-14T07:13:25.744Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37282"
      ],
      "x_nadsec_orgs": [
        "MAINONE"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--78cbc3a7-61e6-4de6-8afc-0772c1501502",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.192.222.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T07:50:54.031Z",
      "x_nadsec_last_seen": "2026-05-14T07:52:59.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b3c53e8e-a30a-4ac2-9cec-331055fc67e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.36.21.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T07:56:03.356Z",
      "x_nadsec_last_seen": "2026-05-14T07:58:09.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e27be004-fe95-4284-9a4d-ede51203f981",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T07:56:56.943Z",
      "x_nadsec_last_seen": "2026-05-14T07:56:56.943Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--91c8deea-b6d4-4b1c-a7c7-364ec9bf77fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.141.98.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T07:20:06.499Z",
      "x_nadsec_last_seen": "2026-05-14T07:22:13.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--e3634c5a-ee25-41f8-bab5-55e59f27989f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T07:20:34.308Z",
      "x_nadsec_last_seen": "2026-05-25T16:01:55.817Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=45929; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e3feaaf8-7ec0-4370-b5d3-4938b6cc6a92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T07:25:49.454Z",
      "x_nadsec_last_seen": "2026-05-14T07:25:49.458Z",
      "x_nadsec_ports": [
        "42",
        "45929"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-14T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=38835; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--37c94036-d5e7-489d-ae3c-ecb383d27ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:05:05.000Z",
      "valid_until": "2026-06-15T08:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T07:25:48.433Z",
      "x_nadsec_last_seen": "2026-05-14T07:25:48.436Z",
      "x_nadsec_ports": [
        "42",
        "38835"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--c2128113-a42f-4234-ad86-37ec244a7b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.223.10.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T08:25:32.745Z",
      "x_nadsec_last_seen": "2026-05-14T08:30:01.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=131215; asn_org=116 MADHAV DARSHAN",
      "id": "indicator--25944b0a-9a3a-4e64-a7ae-aefadda84642",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.235.72.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T09:03:27.605Z",
      "x_nadsec_last_seen": "2026-05-14T09:09:56.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131215"
      ],
      "x_nadsec_orgs": [
        "116 MADHAV DARSHAN"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e08f1aad-8f9f-4434-b8b7-498550279ab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.200.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T08:44:51.268Z",
      "x_nadsec_last_seen": "2026-05-14T08:44:51.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=208972; asn_org=Gibirnet Iletisim Hizmetleri Sanayi Ve Ticaret Limited Sirketi",
      "id": "indicator--c669fec0-c508-4937-845d-1b5b649b0b0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.34.200.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T08:09:34.166Z",
      "x_nadsec_last_seen": "2026-05-14T08:11:40.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "208972"
      ],
      "x_nadsec_orgs": [
        "Gibirnet Iletisim Hizmetleri Sanayi Ve Ticaret Limited Sirketi"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--89f8d8f5-f5e4-4016-9d33-096f0b426109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.144.84.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T08:59:40.574Z",
      "x_nadsec_last_seen": "2026-05-14T08:59:43.732Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53078; asn_org=Acesse Comunicacao Ltda",
      "id": "indicator--53c85515-5871-485a-a901-d644886149c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.94.215.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-14T08:27:40.349Z",
      "x_nadsec_last_seen": "2026-05-24T18:12:32.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53078"
      ],
      "x_nadsec_orgs": [
        "Acesse Comunicacao Ltda"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--48399f67-39f7-452f-b32d-3496a3ae32f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.52.210.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T08:44:46.717Z",
      "x_nadsec_last_seen": "2026-05-14T08:46:53.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0ad7cdcf-0ff1-43e0-8830-58019f0a058b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.118.209.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T08:31:02.859Z",
      "x_nadsec_last_seen": "2026-05-14T08:31:02.859Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--e672c7a3-98da-4332-a0d2-62e04f6182dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.235.16.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T08:47:56.739Z",
      "x_nadsec_last_seen": "2026-05-14T08:54:28.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-14T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7aa47f3d-4381-431f-a65c-4538790378db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.49.186.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:05:10.000Z",
      "valid_until": "2026-06-15T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T08:40:46.070Z",
      "x_nadsec_last_seen": "2026-05-14T08:42:53.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--9224edb5-7da2-4760-b099-057b2662977d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.20.157.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T09:17:05.942Z",
      "x_nadsec_last_seen": "2026-05-14T09:19:10.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--d9bfb1b2-7f8d-4248-9a1f-30ad93f28a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.234.107.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T09:48:19.599Z",
      "x_nadsec_last_seen": "2026-05-14T09:50:24.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--38af5f3f-e8da-4d54-a512-3ece5ad10091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.124.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T10:01:36.388Z",
      "x_nadsec_last_seen": "2026-05-14T10:01:46.775Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=GE; asn=44327; asn_org=Delta Comm LLC",
      "id": "indicator--4cb2584e-e632-40e7-a612-bb2c24ee15d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.131.224.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T10:02:40.479Z",
      "x_nadsec_last_seen": "2026-05-14T10:04:48.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "44327"
      ],
      "x_nadsec_orgs": [
        "Delta Comm LLC"
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CA; asn=54527; asn_org=Astute Internet",
      "id": "indicator--22b810bf-02ae-4eb8-8718-855f9b73752b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.38.41.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T09:14:59.491Z",
      "x_nadsec_last_seen": "2026-05-14T09:15:00.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "54527"
      ],
      "x_nadsec_orgs": [
        "Astute Internet"
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--468490fe-c298-46e1-88c3-4091b87793a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T09:32:26.797Z",
      "x_nadsec_last_seen": "2026-05-14T09:32:49.348Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU",
      "id": "indicator--69061a7f-fd0a-400f-a1c9-e15286119969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.91.118.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T09:42:43.718Z",
      "x_nadsec_last_seen": "2026-05-14T09:42:59.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=15704; asn_org=Xtra Telecom S.A.",
      "id": "indicator--46069435-804f-49b9-836d-aadc764b99f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.87.216.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T09:36:58.637Z",
      "x_nadsec_last_seen": "2026-05-14T09:39:04.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "15704"
      ],
      "x_nadsec_orgs": [
        "Xtra Telecom S.A."
      ]
    },
    {
      "created": "2026-05-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--f1cfe821-66d2-47cb-adbf-1b2b51dd2c29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.26.97.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T10:05:02.000Z",
      "valid_until": "2026-06-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T09:40:35.995Z",
      "x_nadsec_last_seen": "2026-05-14T09:48:54.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--1340cd1c-d297-4d4a-9bad-8cd13201443d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.232.129.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T13:01:04.140Z",
      "x_nadsec_last_seen": "2026-05-14T13:03:09.860Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=151750; asn_org=K-anandraj Inet Solutions Private Limited",
      "id": "indicator--bd8d326f-eb42-4bf7-a560-d27a1e2bdb5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.15.234.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-14T13:02:26.767Z",
      "x_nadsec_last_seen": "2026-05-29T09:48:30.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151750"
      ],
      "x_nadsec_orgs": [
        "K-anandraj Inet Solutions Private Limited"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53240; asn_org=Net Onze Provedor de Acesso a Internet Eireli",
      "id": "indicator--0e45b88e-1075-4263-81b7-228db1f86eb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.227.150.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T12:51:17.415Z",
      "x_nadsec_last_seen": "2026-05-14T12:53:23.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53240"
      ],
      "x_nadsec_orgs": [
        "Net Onze Provedor de Acesso a Internet Eireli"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ce47c7f7-d15f-4d5a-a44a-bd26697027b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.212.224.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T12:34:36.127Z",
      "x_nadsec_last_seen": "2026-05-14T12:34:36.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--f66f2dc1-4bee-48be-8681-9d77ac0b46af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.155.65.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T12:54:05.888Z",
      "x_nadsec_last_seen": "2026-05-14T12:56:13.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--2ca4f43e-3073-4e1d-8be8-0c681555fabf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.141.84.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T12:15:28.661Z",
      "x_nadsec_last_seen": "2026-05-14T12:16:48.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=ftpd; ports=21; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.161.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-14T12:34:25.227Z",
      "x_nadsec_last_seen": "2026-05-14T12:38:44.187Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "445",
        "1433",
        "1723",
        "3306",
        "41833"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-14T13:08:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9b89c09d-5cf6-403e-bcd6-3f41628f1121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T13:08:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:08:36.000Z",
      "valid_until": "2026-06-15T13:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T12:25:22.933Z",
      "x_nadsec_last_seen": "2026-05-19T05:36:54.440Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8dca1ef5-2c92-40f5-b884-47f453486b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.45.70.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T13:08:58.282Z",
      "x_nadsec_last_seen": "2026-05-14T13:08:58.282Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fbc5a974-e439-4ee8-9c6c-332f583af808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.180.181.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T13:14:10.284Z",
      "x_nadsec_last_seen": "2026-05-14T13:14:10.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4b2fef8d-b94c-4065-bcb4-84452dea657d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.180.221.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T13:14:10.723Z",
      "x_nadsec_last_seen": "2026-05-14T13:14:10.723Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--74ca75ae-cda0-48d6-b320-3d0be366a4db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.192.221.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T13:14:18.063Z",
      "x_nadsec_last_seen": "2026-05-14T13:14:18.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--06f41c72-fdcd-48df-be65-99a71a47e069",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.209.233.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T11:53:58.535Z",
      "x_nadsec_last_seen": "2026-05-14T14:01:49.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--844dbc9e-03b6-4e80-8f20-957bf9cad3d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.86.121.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T13:45:57.543Z",
      "x_nadsec_last_seen": "2026-05-14T13:48:02.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--773b9909-5423-40be-ae60-46789872ad76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.55.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T13:32:47.626Z",
      "x_nadsec_last_seen": "2026-05-14T13:34:55.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-14T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2faa8d29-2928-456e-a472-53084abcb47d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.36.149.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T14:05:02.000Z",
      "valid_until": "2026-06-15T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T13:14:15.883Z",
      "x_nadsec_last_seen": "2026-05-14T13:14:15.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--2b0529d6-ba3e-466e-ae59-5c95a6c634ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.233.192.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:05:10.000Z",
      "valid_until": "2026-06-15T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T15:05:42.404Z",
      "x_nadsec_last_seen": "2026-05-14T15:07:47.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-05-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f6b8ec71-3722-478a-bad5-c197209ca7b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.38.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:05:10.000Z",
      "valid_until": "2026-06-15T16:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-14T14:55:11.374Z",
      "x_nadsec_last_seen": "2026-05-14T15:07:14.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e98a62cd-d565-4d69-a077-20a3b403af3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.152.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:05:10.000Z",
      "valid_until": "2026-06-15T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T15:44:13.728Z",
      "x_nadsec_last_seen": "2026-05-14T15:46:18.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--bdfed098-3063-4116-9841-19eb7779fd9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.230.253.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:05:10.000Z",
      "valid_until": "2026-06-15T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T15:06:51.688Z",
      "x_nadsec_last_seen": "2026-05-14T15:12:11.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--247df011-3986-49cc-9e3c-adcdebd2dd8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.116.178.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:05:10.000Z",
      "valid_until": "2026-06-15T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T15:59:31.862Z",
      "x_nadsec_last_seen": "2026-05-14T16:01:39.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-05-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ea108cc2-7117-4bad-8676-1a649b7b7ffa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.44.150.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:05:10.000Z",
      "valid_until": "2026-06-15T16:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T14:30:31.131Z",
      "x_nadsec_last_seen": "2026-05-14T15:57:22.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--0aa0b29e-c0f3-46ea-9aee-382efd49b419",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.130.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:05:10.000Z",
      "valid_until": "2026-06-15T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T15:22:08.583Z",
      "x_nadsec_last_seen": "2026-05-14T15:22:08.583Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1f1b5bea-76b1-472a-8def-72ea35ca84ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.167.166.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T16:53:45.397Z",
      "x_nadsec_last_seen": "2026-05-14T17:00:39.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b48bff72-45e4-460b-b663-744c0dcab0a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.240.94.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T16:45:35.318Z",
      "x_nadsec_last_seen": "2026-05-14T16:45:35.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--1acfdd36-493c-46d2-a8bb-34c40f48f335",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.132.110.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T16:11:27.866Z",
      "x_nadsec_last_seen": "2026-05-14T16:18:49.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T16:26:55.154Z",
      "x_nadsec_last_seen": "2026-05-22T00:10:30.194Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d49ec940-d5b9-44d5-a0d4-46a0ca11c4bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.162.24.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T16:07:52.191Z",
      "x_nadsec_last_seen": "2026-05-14T16:09:59.245Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9e9948d6-afdf-41c4-840e-8385eed05713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.226.69.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T16:29:48.130Z",
      "x_nadsec_last_seen": "2026-05-14T16:31:53.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=12430; asn_org=Vodafone Spain",
      "id": "indicator--6d92cc0e-b57a-4f95-bea3-272904c3549b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.225.122.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T16:22:26.086Z",
      "x_nadsec_last_seen": "2026-05-17T13:54:14.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12430"
      ],
      "x_nadsec_orgs": [
        "Vodafone Spain"
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AZ; asn=29584; asn_org=Azedunet LLC",
      "id": "indicator--a6a2ec49-3a23-49c3-a214-99f7c14dccd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.194.6.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T16:46:19.197Z",
      "x_nadsec_last_seen": "2026-05-19T20:58:30.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "29584"
      ],
      "x_nadsec_orgs": [
        "Azedunet LLC"
      ]
    },
    {
      "created": "2026-05-14T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=mysqld; ports=3306; cc=DK; asn=42708; asn_org=Glesys AB; user(top)=a***n",
      "id": "indicator--d6b29a40-eec8-4b80-a738-cd13e9abbcf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.203.47.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T17:05:10.000Z",
      "valid_until": "2026-06-15T17:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-05-14T16:43:40.208Z",
      "x_nadsec_last_seen": "2026-05-14T21:10:03.830Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DK"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n",
        "d****r",
        "a****0",
        "c**n",
        "c*****l"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c7152a83-7e12-48ce-be12-97d72ab51699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.135.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:05:16.000Z",
      "valid_until": "2026-06-15T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T17:53:55.543Z",
      "x_nadsec_last_seen": "2026-05-14T17:54:24.664Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-14T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:05:16.000Z",
      "valid_until": "2026-06-15T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T17:52:55.661Z",
      "x_nadsec_last_seen": "2026-05-14T17:52:55.661Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=140454; asn_org=PT Pop Net Indonesia",
      "id": "indicator--c2a8bb1f-5372-4f74-b968-feccd4fb49cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.108.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T18:29:22.972Z",
      "x_nadsec_last_seen": "2026-05-14T18:31:28.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140454"
      ],
      "x_nadsec_orgs": [
        "PT Pop Net Indonesia"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4a524640-61de-4ca3-b8de-0308c4fee872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.146.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T18:51:32.772Z",
      "x_nadsec_last_seen": "2026-05-14T18:51:53.453Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4efbda66-a53b-48ce-b006-b54d5d8c9ffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.157.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T18:05:41.048Z",
      "x_nadsec_last_seen": "2026-05-14T18:06:04.873Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HK; asn=134365; asn_org=Ansheng Network Technology Co., Limited",
      "id": "indicator--0022e6ee-e565-4a79-add6-23e76f6e42c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.194.251.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T18:46:21.740Z",
      "x_nadsec_last_seen": "2026-05-14T18:53:40.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "134365"
      ],
      "x_nadsec_orgs": [
        "Ansheng Network Technology Co., Limited"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c181108b-cb0d-46ab-8323-ca3cc9bacfb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.199.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-14T18:10:42.789Z",
      "x_nadsec_last_seen": "2026-05-14T18:11:45.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--4a0d8161-720a-43c7-aceb-7509892f4a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.97.182.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 200,
      "x_nadsec_first_seen": "2026-05-14T18:24:05.438Z",
      "x_nadsec_last_seen": "2026-05-27T14:18:45.095Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--efe6d02e-955d-440b-9a61-089b29503500",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T18:41:54.242Z",
      "x_nadsec_last_seen": "2026-05-14T18:42:14.217Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=27837; asn_org=Dialnet de Colombia S.A. E.S.P.; user(top)=**",
      "id": "indicator--3062bce4-4e21-4683-a3a8-62e12c88c89d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.1.167.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T18:43:21.472Z",
      "x_nadsec_last_seen": "2026-05-16T03:30:17.865Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27837"
      ],
      "x_nadsec_orgs": [
        "Dialnet de Colombia S.A. E.S.P."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--c343e197-c3b8-45fe-8e53-ea3be6be1abf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.243.78.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T18:41:56.075Z",
      "x_nadsec_last_seen": "2026-05-28T15:44:42.688Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T18:48:32.871Z",
      "x_nadsec_last_seen": "2026-05-14T18:48:32.871Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--28e96550-62ac-4504-9992-b4fa47ffe81f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.135.113.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-14T18:58:27.460Z",
      "x_nadsec_last_seen": "2026-05-28T02:50:18.387Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=28539; asn_org=JOSE MIGUEL MACIAS CONTRERAS",
      "id": "indicator--57b406e4-fad6-4984-bae0-e94b2407d8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.159.101.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T19:04:46.353Z",
      "x_nadsec_last_seen": "2026-05-14T19:04:46.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28539"
      ],
      "x_nadsec_orgs": [
        "JOSE MIGUEL MACIAS CONTRERAS"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--1e50580d-74b2-48fe-b2a5-c730057f6e8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.185.17.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T18:52:57.493Z",
      "x_nadsec_last_seen": "2026-05-14T18:52:59.483Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7f0e386d-9103-44ad-a17b-bdc0655d407f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.131.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T19:04:23.722Z",
      "x_nadsec_last_seen": "2026-05-14T19:04:23.722Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=29046; asn_org=Radiobaylanys LLP",
      "id": "indicator--ca3bd0d9-70f5-4bea-b909-77c9e00db9d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.18.38.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T18:37:01.610Z",
      "x_nadsec_last_seen": "2026-05-18T08:38:33.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "29046"
      ],
      "x_nadsec_orgs": [
        "Radiobaylanys LLP"
      ]
    },
    {
      "created": "2026-05-14T19:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--04356b0d-5e50-457f-887e-2b2c069a2534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T19:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.84.79.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T19:05:17.000Z",
      "valid_until": "2026-06-15T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T18:59:02.958Z",
      "x_nadsec_last_seen": "2026-05-14T19:05:45.804Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-05-14T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=20; services=mirrord; ports=42; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--58d6cfc9-cb81-44d5-a118-a12b220ec545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.180.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:05:10.000Z",
      "valid_until": "2026-06-15T20:05:09.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-05-14T19:58:54.683Z",
      "x_nadsec_last_seen": "2026-05-14T19:59:43.532Z",
      "x_nadsec_ports": [
        "42",
        "33955",
        "35635",
        "36231",
        "36489",
        "36781",
        "39501",
        "39945",
        "40159",
        "41063"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-14T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--d8148c42-b57e-434b-b432-934e8d080d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:05:10.000Z",
      "valid_until": "2026-06-15T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T19:36:37.999Z",
      "x_nadsec_last_seen": "2026-05-22T02:31:21.981Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-14T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--ec28ee9f-03d2-4c06-9a7e-82d05e381f1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:05:10.000Z",
      "valid_until": "2026-06-15T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T19:29:29.693Z",
      "x_nadsec_last_seen": "2026-05-14T19:29:34.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-05-14T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--353fe188-04d0-4a25-bda2-12ff9ad03727",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.214.54.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:05:10.000Z",
      "valid_until": "2026-06-15T20:05:09.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-05-14T19:52:50.174Z",
      "x_nadsec_last_seen": "2026-05-15T14:17:47.662Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "201814"
      ],
      "x_nadsec_orgs": [
        "MEVSPACE sp. z o.o."
      ]
    },
    {
      "created": "2026-05-14T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--62bac296-0ed1-4216-93ab-fb04b8ce48ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.110.173.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:05:10.000Z",
      "valid_until": "2026-06-15T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T20:17:22.519Z",
      "x_nadsec_last_seen": "2026-05-14T20:17:22.519Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-14T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9dd6c369-0412-4753-bccd-6141cec33fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:05:10.000Z",
      "valid_until": "2026-06-15T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T20:23:30.361Z",
      "x_nadsec_last_seen": "2026-05-14T20:23:30.361Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-14T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--35cf17b6-7591-4e73-8d36-c399fcab1ff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.106.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:05:10.000Z",
      "valid_until": "2026-06-15T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T21:01:45.705Z",
      "x_nadsec_last_seen": "2026-05-14T21:01:45.705Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--e7322451-c918-4004-8336-c4e226102f5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.11.230.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:05:10.000Z",
      "valid_until": "2026-06-15T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T20:07:19.670Z",
      "x_nadsec_last_seen": "2026-05-14T20:09:26.364Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-14T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T21:05:10.000Z",
      "valid_until": "2026-06-15T21:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T20:30:06.602Z",
      "x_nadsec_last_seen": "2026-05-14T20:30:06.934Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--d12c750a-71c8-4d6a-9147-1555a684425d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.237.178.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:05:10.000Z",
      "valid_until": "2026-06-15T22:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T22:03:32.502Z",
      "x_nadsec_last_seen": "2026-05-14T22:05:40.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-14T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PY; asn=264631; asn_org=RED PARAGUAYA DE TELECOMUNICACIONES SA",
      "id": "indicator--fbedf4da-67d2-4184-97c7-937e4dfd5d04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.202.210.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:05:10.000Z",
      "valid_until": "2026-06-15T22:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T21:46:07.072Z",
      "x_nadsec_last_seen": "2026-05-14T21:46:07.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "264631"
      ],
      "x_nadsec_orgs": [
        "RED PARAGUAYA DE TELECOMUNICACIONES SA"
      ]
    },
    {
      "created": "2026-05-14T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--57e48985-d22c-45b1-a2c9-3480f2843e04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.15.225.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:05:10.000Z",
      "valid_until": "2026-06-15T22:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T21:42:32.576Z",
      "x_nadsec_last_seen": "2026-05-14T21:42:42.750Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-14T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=18734; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--d34e6b43-701b-4257-87e0-e81dd6d1aded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.148.29.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:05:10.000Z",
      "valid_until": "2026-06-15T22:05:04.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-14T21:37:30.884Z",
      "x_nadsec_last_seen": "2026-05-18T15:49:04.750Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "18734"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-14T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dc7ec6fd-c5c1-4e32-bbc3-6ecc7bc34504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.253.220.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:05:10.000Z",
      "valid_until": "2026-06-15T22:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T21:32:57.329Z",
      "x_nadsec_last_seen": "2026-05-14T21:35:02.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-14T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--4e54defc-eef2-493d-8335-7d224a45dfcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.93.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:05:10.000Z",
      "valid_until": "2026-06-15T22:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T21:29:50.510Z",
      "x_nadsec_last_seen": "2026-05-14T21:29:51.027Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-14T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28812; asn_org=PJSC Bashinformsvyaz",
      "id": "indicator--1dc8028e-25dd-40ee-ae78-f166ded2da26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.174.218.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:05:10.000Z",
      "valid_until": "2026-06-15T22:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T21:29:29.283Z",
      "x_nadsec_last_seen": "2026-05-14T21:31:36.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28812"
      ],
      "x_nadsec_orgs": [
        "PJSC Bashinformsvyaz"
      ]
    },
    {
      "created": "2026-05-14T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--3ff647a7-1cab-4757-8139-a0a5bd18ab37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.22.9.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:05:10.000Z",
      "valid_until": "2026-06-15T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T22:08:55.722Z",
      "x_nadsec_last_seen": "2026-05-14T22:15:15.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-14T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--7fee03b7-00c0-413f-b880-41c1dd79b07b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.72.245.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:05:10.000Z",
      "valid_until": "2026-06-15T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T22:05:40.729Z",
      "x_nadsec_last_seen": "2026-05-14T22:07:46.380Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-14T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c065d86c-e836-426a-8fda-24c16865b9a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.46.2.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:05:10.000Z",
      "valid_until": "2026-06-15T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T22:50:34.117Z",
      "x_nadsec_last_seen": "2026-05-14T22:57:55.577Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-14T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--8c18d1a9-d1b1-41fd-b805-6d4eb1ab3524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.61.135.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:05:10.000Z",
      "valid_until": "2026-06-15T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T22:26:22.529Z",
      "x_nadsec_last_seen": "2026-05-14T22:28:27.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-14T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8d65c3b1-0f14-496c-9a37-b8377847e88a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:05:10.000Z",
      "valid_until": "2026-06-15T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T22:53:33.239Z",
      "x_nadsec_last_seen": "2026-05-14T22:53:33.239Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-14T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--09e2cc53-7c79-4d17-968b-90fa3aaed4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.222.181.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:05:10.000Z",
      "valid_until": "2026-06-15T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T22:07:54.076Z",
      "x_nadsec_last_seen": "2026-05-24T05:45:33.711Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-14T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=214036; asn_org=Ultahost, Inc.",
      "id": "indicator--21d35c78-2165-4507-a52c-e3b29c474e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-14T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.200.125.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:05:10.000Z",
      "valid_until": "2026-06-15T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T22:49:07.863Z",
      "x_nadsec_last_seen": "2026-05-14T22:49:07.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "214036"
      ],
      "x_nadsec_orgs": [
        "Ultahost, Inc."
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--ffa1c1f6-9936-4dc2-9f96-180ca3300eaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.51.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T23:47:43.241Z",
      "x_nadsec_last_seen": "2026-05-14T23:54:21.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--e73b4dac-094b-4741-a790-1def04c45925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.187.149.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T23:10:34.267Z",
      "x_nadsec_last_seen": "2026-05-28T15:16:56.628Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0fbb174c-49b0-4fb5-bc00-563e89943b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.25.20.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-14T23:19:03.465Z",
      "x_nadsec_last_seen": "2026-05-14T23:25:34.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--be976e5c-7f61-4ed2-a6c0-110130d4cb95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.77.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T23:28:42.984Z",
      "x_nadsec_last_seen": "2026-05-14T23:30:47.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--4fae6f48-0d4a-41b7-920a-967fd17a9429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.146.60.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T23:36:22.577Z",
      "x_nadsec_last_seen": "2026-05-14T23:38:28.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--5f9fe9bf-7c93-4670-9b65-813ce1838c54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.95.75.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T23:44:24.298Z",
      "x_nadsec_last_seen": "2026-05-14T23:46:30.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=395092; asn_org=Shock Hosting LLC",
      "id": "indicator--0d72daf4-f05a-4133-9f36-97a82c91e335",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.139.207.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-14T23:11:57.226Z",
      "x_nadsec_last_seen": "2026-05-14T23:11:57.226Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "395092"
      ],
      "x_nadsec_orgs": [
        "Shock Hosting LLC"
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8e3acc7c-5d55-4655-8099-d49bd15f7809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-14T23:18:32.975Z",
      "x_nadsec_last_seen": "2026-05-30T10:31:58.793Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-15T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=21479; asn_org=Rostelecom",
      "id": "indicator--ebd643ab-9094-4065-a17e-9d2473b1fbf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.117.2.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:05:04.000Z",
      "valid_until": "2026-06-16T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T23:07:53.285Z",
      "x_nadsec_last_seen": "2026-05-14T23:09:59.977Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21479"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-15T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--4961bf5a-2a28-4ca2-8770-e6a3a0f53bc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.41.97.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:05:10.000Z",
      "valid_until": "2026-06-16T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T00:54:28.484Z",
      "x_nadsec_last_seen": "2026-05-15T00:54:28.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-05-15T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--69af1ab1-7a9f-4d42-b235-e2a7011fd13d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.93.21.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:05:10.000Z",
      "valid_until": "2026-06-16T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T00:54:28.745Z",
      "x_nadsec_last_seen": "2026-05-15T00:55:27.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-15T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--bec7a5bc-054e-45c5-84f2-37b56d067bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.252.188.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:05:10.000Z",
      "valid_until": "2026-06-16T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T00:20:26.208Z",
      "x_nadsec_last_seen": "2026-05-15T00:20:26.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-15T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=53158; asn_org=Net Turbo Telecom",
      "id": "indicator--ebea11fd-2162-4626-b0e3-1afa2c76e292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.108.83.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:05:10.000Z",
      "valid_until": "2026-06-16T01:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-15T00:39:01.917Z",
      "x_nadsec_last_seen": "2026-05-15T19:24:23.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53158"
      ],
      "x_nadsec_orgs": [
        "Net Turbo Telecom"
      ]
    },
    {
      "created": "2026-05-15T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9fd87a23-fe6c-476d-8c14-0a87f56b3b08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.150.194.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:05:10.000Z",
      "valid_until": "2026-06-16T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T01:00:33.385Z",
      "x_nadsec_last_seen": "2026-05-15T01:00:43.563Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ba8707bb-e445-43bc-9ae2-a873ed19048b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.226.103.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-05-15T02:00:09.699Z",
      "x_nadsec_last_seen": "2026-05-15T02:02:40.893Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T01:36:57.745Z",
      "x_nadsec_last_seen": "2026-05-15T01:36:57.745Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--aa1593a3-4458-44c3-913d-2ee4f55dc37e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T01:25:39.695Z",
      "x_nadsec_last_seen": "2026-05-15T01:25:40.046Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--541e2787-d111-40ba-8c57-4f436332ce96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.125.150.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T01:06:33.470Z",
      "x_nadsec_last_seen": "2026-05-15T01:07:14.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=30855; asn_org=Tele-plus LLC",
      "id": "indicator--9376711f-9abd-42a5-a157-1b39e289f81b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.114.184.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T01:30:07.753Z",
      "x_nadsec_last_seen": "2026-05-15T01:32:14.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "30855"
      ],
      "x_nadsec_orgs": [
        "Tele-plus LLC"
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--20c5b794-e21b-4c83-bf11-6cfc4003a78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.92.182.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T01:05:21.674Z",
      "x_nadsec_last_seen": "2026-05-15T01:05:21.674Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--66bf2a68-21fa-409d-9b8b-932eb9be1836",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.175.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T01:46:52.165Z",
      "x_nadsec_last_seen": "2026-05-19T20:40:24.258Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--34556fb6-5b8b-4d0e-a0b0-479155349980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.186.129.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T01:35:39.147Z",
      "x_nadsec_last_seen": "2026-05-15T01:40:33.956Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-15T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--9896e034-7ce1-4292-8058-62673b5c1de7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:05:10.000Z",
      "valid_until": "2026-06-16T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T01:38:11.891Z",
      "x_nadsec_last_seen": "2026-05-15T01:40:18.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--37273a95-8d2f-4b74-9c2e-4b5e03fc013f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.69.161.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T02:53:42.372Z",
      "x_nadsec_last_seen": "2026-05-15T02:58:07.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c5e27439-4d11-471a-a1bb-d82fe2f44054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.210.47.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-15T02:07:29.439Z",
      "x_nadsec_last_seen": "2026-05-15T02:20:07.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b4bb2b29-1d39-4093-a1cb-6989b00cfee6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.161.50.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T02:31:09.586Z",
      "x_nadsec_last_seen": "2026-05-15T02:31:14.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network",
      "id": "indicator--62412275-348a-4fc4-a201-bb544c3d67bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.18.96.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T02:46:57.589Z",
      "x_nadsec_last_seen": "2026-05-30T03:20:55.942Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58466"
      ],
      "x_nadsec_orgs": [
        "CHINANET Guangdong province network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6a75b582-b2e2-4244-8a78-632ac030de77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.208.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T02:12:01.995Z",
      "x_nadsec_last_seen": "2026-05-15T02:12:31.866Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--76f0bd23-9b7b-4f9b-93e6-e3a0069cc3cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.199.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T03:00:20.441Z",
      "x_nadsec_last_seen": "2026-05-15T03:00:20.441Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--02f53cfc-c487-4a9b-8bb3-20ce53f3e2f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.241.176.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T03:01:37.360Z",
      "x_nadsec_last_seen": "2026-05-15T03:02:10.177Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17813; asn_org=Mahanagar Telephone Nigam Limited",
      "id": "indicator--690506b8-015e-4301-837a-1d64b378118f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.180.128.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T02:05:19.449Z",
      "x_nadsec_last_seen": "2026-05-15T02:07:24.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17813"
      ],
      "x_nadsec_orgs": [
        "Mahanagar Telephone Nigam Limited"
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b45533cc-4a62-4042-b6d2-e4b794eef3e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T02:11:58.512Z",
      "x_nadsec_last_seen": "2026-05-15T02:11:58.512Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-15T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--a1f6708a-de77-4f0e-91a9-6f4ee0ccfba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.249.221.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:05:06.000Z",
      "valid_until": "2026-06-16T03:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T02:50:14.221Z",
      "x_nadsec_last_seen": "2026-05-15T02:57:21.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135139; asn_org=Skylink Fibernet Private Limited",
      "id": "indicator--2c8c024c-caad-40dc-b6a5-9f7ddd5072eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.130.205.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T03:43:53.253Z",
      "x_nadsec_last_seen": "2026-05-15T03:46:06.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135139"
      ],
      "x_nadsec_orgs": [
        "Skylink Fibernet Private Limited"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DK; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--6a8c47c6-2450-4f5c-97ed-2e1cfd0f6a4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.247.232.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T03:49:41.675Z",
      "x_nadsec_last_seen": "2026-05-15T03:49:41.675Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DK"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=QA; asn=8781; asn_org=Ooredoo Q.S.C.",
      "id": "indicator--4805e460-34a0-4f5c-9f5a-5e598f0a77c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.202.13.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T03:55:06.899Z",
      "x_nadsec_last_seen": "2026-05-15T03:57:11.930Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "QA"
      ],
      "x_nadsec_asns": [
        "8781"
      ],
      "x_nadsec_orgs": [
        "Ooredoo Q.S.C."
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=51747; asn_org=Internet Vikings International AB",
      "id": "indicator--21b90e7c-5fe4-4a4d-8039-c88b82be7242",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.71.63.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T03:49:06.830Z",
      "x_nadsec_last_seen": "2026-05-15T03:49:06.830Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "51747"
      ],
      "x_nadsec_orgs": [
        "Internet Vikings International AB"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SE; asn=51747; asn_org=Internet Vikings International AB",
      "id": "indicator--63628dee-b668-401f-af4b-90470e0523ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.235.22.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T03:48:41.710Z",
      "x_nadsec_last_seen": "2026-05-15T03:48:41.710Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "51747"
      ],
      "x_nadsec_orgs": [
        "Internet Vikings International AB"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NO; asn=51747; asn_org=Internet Vikings International AB",
      "id": "indicator--53beb894-9f35-45a1-80ef-9ad8f4d67913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.71.23.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T03:48:55.281Z",
      "x_nadsec_last_seen": "2026-05-15T03:48:55.281Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "51747"
      ],
      "x_nadsec_orgs": [
        "Internet Vikings International AB"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cd858af1-4bba-41b6-9637-ad7d4d0decc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.98.137.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T04:03:25.427Z",
      "x_nadsec_last_seen": "2026-05-16T04:19:09.128Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--80586eda-69c8-488a-bee7-4bcf63953a23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.114.206.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T03:19:01.990Z",
      "x_nadsec_last_seen": "2026-05-15T03:21:08.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--72209dae-5c1b-4757-87be-0e9c432dbec6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.220.251.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T03:28:30.942Z",
      "x_nadsec_last_seen": "2026-05-15T03:30:35.897Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d0e2f365-cef7-4804-b01f-c0892d684a06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T03:20:51.049Z",
      "x_nadsec_last_seen": "2026-05-25T02:37:24.729Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=ftpd; ports=21; cc=IT; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--e9dac137-3539-42aa-a55b-a065002ddaf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.140.108.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-15T03:48:40.352Z",
      "x_nadsec_last_seen": "2026-05-15T03:49:31.793Z",
      "x_nadsec_ports": [
        "21",
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d45cfbef-b7a4-4288-9ffe-7b064b78409d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T03:51:41.970Z",
      "x_nadsec_last_seen": "2026-05-15T03:51:41.970Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-15T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5ccfc3ea-8b68-4de8-93f4-550d9d1a829f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:05:11.000Z",
      "valid_until": "2026-06-16T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T03:51:41.764Z",
      "x_nadsec_last_seen": "2026-05-15T03:51:41.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--57805935-3be8-47e0-9852-0f19a278099a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.164.37.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T04:40:01.701Z",
      "x_nadsec_last_seen": "2026-05-15T04:46:32.832Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.16.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-15T04:30:43.467Z",
      "x_nadsec_last_seen": "2026-05-15T04:33:44.598Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "36489"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--5c8c2e56-5855-4ab0-8c8d-aa7a3e297300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.28.247.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-15T04:42:41.758Z",
      "x_nadsec_last_seen": "2026-05-16T02:22:10.990Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CL; asn=14259; asn_org=Gtd Internet S.A.; user(top)=**",
      "id": "indicator--d96c08c3-02b1-4237-8437-82ea4c96ca5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.238.213.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T04:49:08.474Z",
      "x_nadsec_last_seen": "2026-05-15T04:49:08.474Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14259"
      ],
      "x_nadsec_orgs": [
        "Gtd Internet S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9c4825e7-ec68-4e7b-8e02-0c623b0604d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.38.195.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T04:58:57.857Z",
      "x_nadsec_last_seen": "2026-05-27T09:05:20.329Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1182a548-ef92-47bc-9f8a-c5e5d2334dfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.92.104.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T04:29:01.338Z",
      "x_nadsec_last_seen": "2026-05-15T04:35:38.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--876c22a9-ae1a-454b-ac7e-d486be504459",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.41.27.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T04:12:52.383Z",
      "x_nadsec_last_seen": "2026-05-15T04:19:53.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-15T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=44961; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--f807793a-930e-4c09-a593-702cc9e51cb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:05:10.000Z",
      "valid_until": "2026-06-16T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T05:03:47.489Z",
      "x_nadsec_last_seen": "2026-05-26T21:58:22.438Z",
      "x_nadsec_ports": [
        "42",
        "27017",
        "44961"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--46a665b1-a030-44dd-9f60-d8540eb02217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.249.60.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T05:28:56.155Z",
      "x_nadsec_last_seen": "2026-05-15T05:28:56.155Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5a7be381-7aae-42d6-b9d5-87719aefb0dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T06:01:59.323Z",
      "x_nadsec_last_seen": "2026-05-15T06:01:59.323Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=58898; asn_org=Rainbow communications India Pvt Ltd",
      "id": "indicator--e59612e4-4d81-487f-ba34-f7e4c28d70f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '163.53.206.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T05:24:06.442Z",
      "x_nadsec_last_seen": "2026-05-15T05:24:11.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58898"
      ],
      "x_nadsec_orgs": [
        "Rainbow communications India Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--15580792-4466-43f8-9d20-1ffeef0b21be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.242.10.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T05:43:32.171Z",
      "x_nadsec_last_seen": "2026-05-15T05:50:02.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--ae314f14-4c50-48b8-a5f6-d37727da9f24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.23.101.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T05:33:21.281Z",
      "x_nadsec_last_seen": "2026-05-15T05:33:28.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VE; asn=6306; asn_org=TELEFONICA VENEZOLANA, C.A.",
      "id": "indicator--b4889467-5f9d-4eb8-9cbd-4083bce3b516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.35.109.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-15T05:56:14.707Z",
      "x_nadsec_last_seen": "2026-05-31T10:44:45.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "6306"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA VENEZOLANA, C.A."
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--cba7192b-2893-43e2-ae7f-e75b47fff7bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.199.170.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T05:28:50.880Z",
      "x_nadsec_last_seen": "2026-05-15T05:28:50.880Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--eb7c4519-0d81-4600-9f54-7b66d38ee6b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.204.71.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T05:11:23.182Z",
      "x_nadsec_last_seen": "2026-05-15T05:17:42.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=138421; asn_org=China Unicom",
      "id": "indicator--ac243f18-d8c8-4420-bd07-9f81fdad94e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.240.193.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T05:24:07.529Z",
      "x_nadsec_last_seen": "2026-05-15T05:24:07.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "138421"
      ],
      "x_nadsec_orgs": [
        "China Unicom"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b0f47210-bad0-4cac-827c-83b5b72e0d3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.214.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T06:01:53.372Z",
      "x_nadsec_last_seen": "2026-05-15T06:02:16.935Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=RU; asn=29072; asn_org=Regional Digital Telecommunication Company LLC",
      "id": "indicator--f796eaaf-1668-4c74-9209-f1f634c03e69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.231.172.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-15T05:21:15.048Z",
      "x_nadsec_last_seen": "2026-05-15T05:38:25.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29072"
      ],
      "x_nadsec_orgs": [
        "Regional Digital Telecommunication Company LLC"
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--b3ab6d9b-4400-4afd-98ab-09c70bf29805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T05:11:05.751Z",
      "x_nadsec_last_seen": "2026-05-15T05:11:05.751Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--335ba962-161f-4936-b422-1aa824bfc4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T05:05:46.365Z",
      "x_nadsec_last_seen": "2026-05-15T05:05:46.365Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--514611aa-afb5-4ae9-a3ed-b77b2fbb8d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T05:07:48.778Z",
      "x_nadsec_last_seen": "2026-05-15T05:07:48.778Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-15T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f44a7b0a-f104-4db6-93dc-485947819c3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.126.240.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:05:14.000Z",
      "valid_until": "2026-06-16T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T05:17:28.760Z",
      "x_nadsec_last_seen": "2026-05-15T05:23:15.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--93e45557-a3eb-4209-95a7-fee58cf12915",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.108.251.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T06:20:32.037Z",
      "x_nadsec_last_seen": "2026-05-15T06:20:32.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--2830d2cf-5453-4499-b2f6-9b6d1e497d4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.239.132.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T06:25:53.976Z",
      "x_nadsec_last_seen": "2026-05-15T06:26:19.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--bbd350f0-42d9-4e08-adff-c4d38f6d840c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.2.23.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T06:30:49.491Z",
      "x_nadsec_last_seen": "2026-05-15T06:33:02.391Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--adb2849d-044e-4b02-a2e2-463e8a04ff76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.25.33.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T06:20:36.792Z",
      "x_nadsec_last_seen": "2026-05-15T06:20:41.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--014dbceb-0796-450f-ad2f-fabfcba2fa5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.9.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T06:32:26.585Z",
      "x_nadsec_last_seen": "2026-05-15T06:34:33.805Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--071bd404-0a08-42c0-b003-4766576ad925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.45.199.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T06:45:56.344Z",
      "x_nadsec_last_seen": "2026-05-15T06:48:03.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--cf3b2131-4186-4b57-9c65-8b390a80ab52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.187.95.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T07:05:02.479Z",
      "x_nadsec_last_seen": "2026-05-15T07:07:09.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--7b79c99e-1187-40a6-9482-4e7e5301ffcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.74.55.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T06:36:02.211Z",
      "x_nadsec_last_seen": "2026-05-15T06:38:08.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--7dc7510d-49ea-48a6-b420-89d6e3bf67ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.178.84.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T06:16:17.571Z",
      "x_nadsec_last_seen": "2026-05-15T06:18:21.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d2534d1a-1e80-45b9-a442-3c0ede5ea5ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.70.224.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T06:23:24.005Z",
      "x_nadsec_last_seen": "2026-05-15T06:25:29.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-09T16:40:59.850Z",
      "x_nadsec_last_seen": "2026-05-25T17:47:25.292Z",
      "x_nadsec_ports": [
        "1883",
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--017a83c0-dc50-4c0a-86ec-71ec39e91f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.124.200.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T06:26:11.987Z",
      "x_nadsec_last_seen": "2026-05-15T06:28:16.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-15T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--3575ba12-1df4-4df1-8e7b-99b7c955a8e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.57.254.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:05:11.000Z",
      "valid_until": "2026-06-16T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T07:05:01.022Z",
      "x_nadsec_last_seen": "2026-05-15T07:07:07.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8c82d9df-81a5-4cfc-a5cb-9cb15e6da3ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T07:06:24.983Z",
      "x_nadsec_last_seen": "2026-05-15T18:29:39.232Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--1fd12395-37fd-440e-a2ea-2dc42ef28c1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.243.48.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-15T07:59:49.422Z",
      "x_nadsec_last_seen": "2026-05-15T09:37:35.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=206476; asn_org=Neten S.p.A.",
      "id": "indicator--3b516cab-2e26-4cbb-9e2a-8d04af486b52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.90.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T07:59:01.352Z",
      "x_nadsec_last_seen": "2026-05-15T07:59:07.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "206476"
      ],
      "x_nadsec_orgs": [
        "Neten S.p.A."
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--5788cf66-5606-40e7-9c8b-ece2d0b6fa40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.248.207.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T07:37:46.195Z",
      "x_nadsec_last_seen": "2026-05-15T07:39:53.344Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f7ef3801-6f3b-4e0c-ae2b-e26c2014ab76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.83.69.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T07:55:02.370Z",
      "x_nadsec_last_seen": "2026-05-15T08:01:48.607Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f9cb1710-1f45-4826-9ceb-3084a144b14a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.208.111.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-15T08:04:44.165Z",
      "x_nadsec_last_seen": "2026-05-31T22:47:15.475Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--6ee23d63-dbb5-480e-bef0-8e769b803fc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.248.16.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T07:39:26.179Z",
      "x_nadsec_last_seen": "2026-05-15T07:41:33.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-15T08:06:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=OM; asn=204170; asn_org=Awaser Oman LLC",
      "id": "indicator--49f2cd5b-717a-40b7-ab54-9e8f0e9c71b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T08:06:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.147.137.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T08:06:06.000Z",
      "valid_until": "2026-06-16T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T07:44:24.129Z",
      "x_nadsec_last_seen": "2026-05-28T16:31:11.461Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "204170"
      ],
      "x_nadsec_orgs": [
        "Awaser Oman LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--ab19ea38-fe00-4695-b188-464d8c549de2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.0.171.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T08:20:58.605Z",
      "x_nadsec_last_seen": "2026-05-15T08:23:03.103Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=58369; asn_org=PT. Fiber Networks Indonesia",
      "id": "indicator--51992178-a27d-423b-b158-43b2523c2ef7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.188.171.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T08:48:19.057Z",
      "x_nadsec_last_seen": "2026-05-15T08:54:34.993Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58369"
      ],
      "x_nadsec_orgs": [
        "PT. Fiber Networks Indonesia"
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ea69a55c-14eb-4b1b-9e5d-043118053685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.248.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T08:38:55.760Z",
      "x_nadsec_last_seen": "2026-05-15T08:41:00.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a15ddb79-8076-4ef1-a466-9566c5c1ed33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T08:56:31.486Z",
      "x_nadsec_last_seen": "2026-05-15T08:56:31.486Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e7585f3b-481b-40f1-b7ed-5a1339310566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.228.98.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T08:15:17.744Z",
      "x_nadsec_last_seen": "2026-05-15T08:22:33.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--07dd7737-5879-437f-9736-e24c5caac902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.86.184.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T08:29:05.061Z",
      "x_nadsec_last_seen": "2026-05-15T08:31:09.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--619596ad-90bd-4c6d-bec0-26c36b149600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.114.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T08:54:00.164Z",
      "x_nadsec_last_seen": "2026-05-15T08:54:24.295Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-15T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--0c8c78f8-1366-49b3-afb8-9b9ea828c812",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.59.207.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T09:05:10.000Z",
      "valid_until": "2026-06-16T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T08:50:17.902Z",
      "x_nadsec_last_seen": "2026-05-15T08:52:24.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-15T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**; pass(top)=!******x",
      "id": "indicator--596faded-7d2f-4394-801e-0b5c73f7cf1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.130.220.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:05:10.000Z",
      "valid_until": "2026-06-16T10:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-15T09:21:09.862Z",
      "x_nadsec_last_seen": "2026-05-15T09:25:05.116Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-15T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ab853692-afa9-4c86-b3fd-872b2c502242",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.177.66.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:05:10.000Z",
      "valid_until": "2026-06-16T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T09:08:40.781Z",
      "x_nadsec_last_seen": "2026-05-15T09:10:45.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=52936; asn_org=ONCABO LTDA",
      "id": "indicator--ee41e4a6-1dc1-4406-8c24-ce82868b5519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.185.131.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:05:10.000Z",
      "valid_until": "2026-06-16T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T09:10:07.723Z",
      "x_nadsec_last_seen": "2026-05-15T09:17:33.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52936"
      ],
      "x_nadsec_orgs": [
        "ONCABO LTDA"
      ]
    },
    {
      "created": "2026-05-15T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--301c3910-35ed-44d8-9ffc-d3e4b474786a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.210.71.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:05:10.000Z",
      "valid_until": "2026-06-16T10:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-15T09:26:59.475Z",
      "x_nadsec_last_seen": "2026-05-30T16:50:19.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-05-15T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=38794; asn_org=UIH",
      "id": "indicator--b6d760a5-044e-465d-b2cd-4a2f943a4ec9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.114.71.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:05:10.000Z",
      "valid_until": "2026-06-16T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T09:40:24.444Z",
      "x_nadsec_last_seen": "2026-05-15T09:40:55.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "38794"
      ],
      "x_nadsec_orgs": [
        "UIH"
      ]
    },
    {
      "created": "2026-05-15T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--37b64430-db23-48fb-8a22-ce2f643987d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.70.103.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:05:10.000Z",
      "valid_until": "2026-06-16T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T09:47:22.746Z",
      "x_nadsec_last_seen": "2026-05-15T09:47:22.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--919c4086-5229-47db-9718-03b64de5a415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.244.180.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:05:10.000Z",
      "valid_until": "2026-06-16T10:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-15T09:27:46.873Z",
      "x_nadsec_last_seen": "2026-05-24T14:22:28.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--46d5bb7e-0bf8-428d-ab5a-cf0107785884",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.88.113.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T10:13:22.011Z",
      "x_nadsec_last_seen": "2026-05-15T10:15:30.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--8ab17f56-7943-477a-9dd4-9c8eeeb13215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.144.175.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T10:32:57.991Z",
      "x_nadsec_last_seen": "2026-05-28T08:09:16.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--dd70e6b9-c2ff-477f-a61b-23c29a0e5437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.219.73.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T11:03:45.721Z",
      "x_nadsec_last_seen": "2026-05-15T11:03:45.721Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--769a7aa1-bd19-43f6-b625-b9bcbdf620b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.161.66.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T10:32:57.855Z",
      "x_nadsec_last_seen": "2026-05-15T10:33:03.121Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=150452; asn_org=LANDUPS LIMITED",
      "id": "indicator--780c6de9-1122-4245-b2e9-e087c6ec5cee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.245.220.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T10:31:07.858Z",
      "x_nadsec_last_seen": "2026-05-15T10:33:12.233Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "150452"
      ],
      "x_nadsec_orgs": [
        "LANDUPS LIMITED"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--f0e23e93-2176-451b-b490-9fca4142dedc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.88.167.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T10:31:55.900Z",
      "x_nadsec_last_seen": "2026-05-15T10:31:56.424Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=23750; asn_org=GERRYS INFORMATION TECHNOLOGY PVT LTD.",
      "id": "indicator--a758e1fb-4a22-4476-8e89-0e252e3d1fee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.142.154.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T10:19:44.129Z",
      "x_nadsec_last_seen": "2026-05-15T12:03:02.339Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23750"
      ],
      "x_nadsec_orgs": [
        "GERRYS INFORMATION TECHNOLOGY PVT LTD."
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=55501; asn_org=141-143 Maulana Shaukat Ali Road",
      "id": "indicator--ecb8440e-2c04-4b08-be00-690d1d1bb70f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.166.164.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T10:17:39.343Z",
      "x_nadsec_last_seen": "2026-05-15T12:05:08.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "55501"
      ],
      "x_nadsec_orgs": [
        "141-143 Maulana Shaukat Ali Road"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--26d45a28-472e-4154-ba19-0bb7bca5e200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.212.109.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T10:56:46.613Z",
      "x_nadsec_last_seen": "2026-05-15T10:56:46.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--77b7d4cc-81ce-4fbe-b53d-b369a0129c0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.180.158.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T10:54:13.403Z",
      "x_nadsec_last_seen": "2026-05-15T10:54:23.579Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--27c09052-0927-4e4d-bc12-c22c8e9f342f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.177.142.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T10:24:36.137Z",
      "x_nadsec_last_seen": "2026-05-15T10:26:41.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-15T11:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=UA; asn=51121; asn_org=Foboss-Telecom LLC",
      "id": "indicator--2a47c092-e4bd-48c2-b465-ad69198a591e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T11:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.226.43.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:05:20.000Z",
      "valid_until": "2026-06-16T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T10:47:27.776Z",
      "x_nadsec_last_seen": "2026-05-25T11:48:58.520Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "51121"
      ],
      "x_nadsec_orgs": [
        "Foboss-Telecom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--9a425042-8470-4206-b4f4-ec72444e7171",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.75.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T12:01:01.653Z",
      "x_nadsec_last_seen": "2026-05-15T12:03:09.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=1221; asn_org=Telstra Limited",
      "id": "indicator--6ae25f71-9394-4118-95a7-a544da2ff177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.150.53.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T11:07:15.108Z",
      "x_nadsec_last_seen": "2026-05-15T11:09:18.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "1221"
      ],
      "x_nadsec_orgs": [
        "Telstra Limited"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--a353b6e6-a270-403c-8038-19691228558f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.109.34.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T11:17:40.642Z",
      "x_nadsec_last_seen": "2026-05-15T11:19:46.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=26496; asn_org=GoDaddy.com, LLC",
      "id": "indicator--084c83a3-ecb5-44c4-b7ca-acb04b55c985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.66.133.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T11:08:37.851Z",
      "x_nadsec_last_seen": "2026-05-15T11:08:37.851Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "26496"
      ],
      "x_nadsec_orgs": [
        "GoDaddy.com, LLC"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--304176f8-6b5b-444e-a0b8-310675ac7cd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.158.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-15T11:18:25.595Z",
      "x_nadsec_last_seen": "2026-05-15T11:18:31.012Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a6db1afa-5a9e-4269-a904-da8702622578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T11:58:59.175Z",
      "x_nadsec_last_seen": "2026-05-15T11:58:59.175Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--fbe7af04-7de7-41ab-9a3c-78898d66541e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.176.184.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T11:50:52.403Z",
      "x_nadsec_last_seen": "2026-05-15T11:52:59.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--47d64a1d-f3b2-46a9-ab40-4b9e44355883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.3.111.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T11:36:45.032Z",
      "x_nadsec_last_seen": "2026-05-15T11:38:51.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9cec436d-fc4f-42d0-9056-da457428ba32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.61.157.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T11:54:23.863Z",
      "x_nadsec_last_seen": "2026-05-15T12:00:53.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=13099; asn_org=az-evro Tel LLC",
      "id": "indicator--f49d2321-383d-4103-9526-e5d67cca98cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.172.88.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-15T11:54:00.590Z",
      "x_nadsec_last_seen": "2026-05-25T07:14:02.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "13099"
      ],
      "x_nadsec_orgs": [
        "az-evro Tel LLC"
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--710d3021-1f80-437f-8197-e3423ac84505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T11:58:23.590Z",
      "x_nadsec_last_seen": "2026-05-15T11:58:23.590Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--c69f73ed-6f96-4df7-b6a3-8b8e996f9777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T11:58:23.867Z",
      "x_nadsec_last_seen": "2026-05-15T11:58:23.867Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-15T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--dda0682e-d213-4c3d-8536-2d5ef0639123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T12:05:10.000Z",
      "valid_until": "2026-06-16T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T11:42:45.277Z",
      "x_nadsec_last_seen": "2026-05-15T11:42:45.277Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-15T14:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TM; asn=20661; asn_org=State Company of Electro Communications Turkmentelecom",
      "id": "indicator--1a8b5c35-5da4-40d9-ba6e-3363ac45eba1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.235.125.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:05:15.000Z",
      "valid_until": "2026-06-16T14:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T13:54:42.438Z",
      "x_nadsec_last_seen": "2026-05-15T13:56:48.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TM"
      ],
      "x_nadsec_asns": [
        "20661"
      ],
      "x_nadsec_orgs": [
        "State Company of Electro Communications Turkmentelecom"
      ]
    },
    {
      "created": "2026-05-15T14:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--79c7fc87-e5c2-466a-9f90-280677f838b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.88.167.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:05:15.000Z",
      "valid_until": "2026-06-16T14:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T13:18:02.028Z",
      "x_nadsec_last_seen": "2026-05-15T13:18:02.549Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-15T14:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=20978; asn_org=TT Mobil Iletisim Hizmetleri A.S",
      "id": "indicator--5648d4b4-302d-4768-9585-bf6a479718fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.30.215.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:05:15.000Z",
      "valid_until": "2026-06-16T14:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T13:39:41.612Z",
      "x_nadsec_last_seen": "2026-05-15T13:41:48.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "20978"
      ],
      "x_nadsec_orgs": [
        "TT Mobil Iletisim Hizmetleri A.S"
      ]
    },
    {
      "created": "2026-05-15T14:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--2dd6a1f3-39cb-422c-82df-be4da0ac84f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.87.26.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:05:15.000Z",
      "valid_until": "2026-06-16T14:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-15T14:00:14.174Z",
      "x_nadsec_last_seen": "2026-05-19T09:17:36.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-15T14:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:05:15.000Z",
      "valid_until": "2026-06-16T14:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T13:24:29.657Z",
      "x_nadsec_last_seen": "2026-05-18T15:32:51.190Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-15T14:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--6fd3f78b-1890-471f-b27e-91af0d2e57ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T14:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.149.21.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:05:15.000Z",
      "valid_until": "2026-06-16T14:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T13:13:06.692Z",
      "x_nadsec_last_seen": "2026-05-15T13:15:11.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45528; asn_org=Tikona Infinet Ltd.",
      "id": "indicator--e0a80653-9b0a-4d14-b395-985f7ccbe7e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.22.54.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T14:50:53.714Z",
      "x_nadsec_last_seen": "2026-05-15T14:57:50.904Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45528"
      ],
      "x_nadsec_orgs": [
        "Tikona Infinet Ltd."
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--e2bb6232-8fad-433d-9c7c-be8e6fbe51a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.101.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T15:03:21.006Z",
      "x_nadsec_last_seen": "2026-05-15T15:05:29.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--1bcb2efb-b1dc-474d-aca0-9630725ab139",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.80.210.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T14:14:00.223Z",
      "x_nadsec_last_seen": "2026-05-15T14:16:05.587Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8e40d7b2-206c-46e0-9c18-6cc2c52475ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.86.104.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T14:49:16.034Z",
      "x_nadsec_last_seen": "2026-05-15T14:49:16.034Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=263432; asn_org=CORPORATIVA TELECOMUNICACOES EIRELI ME",
      "id": "indicator--ade40c08-7cb2-4f26-b203-2f14227aab91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.91.77.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T14:07:32.572Z",
      "x_nadsec_last_seen": "2026-05-15T14:08:24.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263432"
      ],
      "x_nadsec_orgs": [
        "CORPORATIVA TELECOMUNICACOES EIRELI ME"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=42610; asn_org=Rostelecom",
      "id": "indicator--729776f5-e6b4-48a2-bc1a-3d868bbd8b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.255.123.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T14:49:36.097Z",
      "x_nadsec_last_seen": "2026-05-15T14:56:51.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42610"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9326; asn_org=PT Centrin Utama",
      "id": "indicator--b41b308a-f036-4b40-82e9-867adb345a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.57.14.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-15T14:47:32.925Z",
      "x_nadsec_last_seen": "2026-05-15T15:28:22.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9326"
      ],
      "x_nadsec_orgs": [
        "PT Centrin Utama"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--cec97e65-8ece-4c2b-8fd3-1028851bb0e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T14:51:22.199Z",
      "x_nadsec_last_seen": "2026-05-29T03:54:24.620Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--e2bdf1d1-eb2f-4797-85db-85184da21d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.138.129.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-15T14:43:08.310Z",
      "x_nadsec_last_seen": "2026-05-18T21:16:16.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-05-15T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--a6f243b8-5fa6-42da-a925-745accf29338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '96.241.201.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:05:10.000Z",
      "valid_until": "2026-06-16T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T14:37:12.311Z",
      "x_nadsec_last_seen": "2026-05-15T14:37:12.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-05-15T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--fdfc4e9d-3ba2-4083-ba88-6942a2d595c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.116.51.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:05:05.000Z",
      "valid_until": "2026-06-16T16:05:03.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-15T15:15:58.074Z",
      "x_nadsec_last_seen": "2026-05-15T15:15:59.296Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-15T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55947; asn_org=Bangalore Broadband Network Pvt Ltd",
      "id": "indicator--195682d3-107e-4623-b36b-e8563c55e067",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.40.244.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:05:05.000Z",
      "valid_until": "2026-06-16T16:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T15:30:14.651Z",
      "x_nadsec_last_seen": "2026-05-15T15:32:20.445Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55947"
      ],
      "x_nadsec_orgs": [
        "Bangalore Broadband Network Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-15T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--79bdc375-c50b-4772-be0a-96ea975b921c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:05:05.000Z",
      "valid_until": "2026-06-16T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T15:06:57.120Z",
      "x_nadsec_last_seen": "2026-05-15T15:06:57.932Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a499dae7-987e-4a69-9b13-7d1add57633d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:05:05.000Z",
      "valid_until": "2026-06-16T16:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T15:25:43.773Z",
      "x_nadsec_last_seen": "2026-05-15T15:25:43.773Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CH; asn=3303; asn_org=Bluewin",
      "id": "indicator--c431e09c-856b-4b31-9c49-312e655b91be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.3.37.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:05:05.000Z",
      "valid_until": "2026-06-16T16:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T15:18:21.631Z",
      "x_nadsec_last_seen": "2026-05-15T15:25:10.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "3303"
      ],
      "x_nadsec_orgs": [
        "Bluewin"
      ]
    },
    {
      "created": "2026-05-15T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:05:05.000Z",
      "valid_until": "2026-06-16T16:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T15:49:45.256Z",
      "x_nadsec_last_seen": "2026-05-17T15:11:30.059Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-15T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--57f63c60-23a9-4af9-9270-879b1d647e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.36.150.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T16:05:05.000Z",
      "valid_until": "2026-06-16T16:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T15:09:56.882Z",
      "x_nadsec_last_seen": "2026-05-15T15:10:01.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-05-15T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d6a8cac0-d0a9-472f-890b-bc053626a7ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.171.210.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:05:05.000Z",
      "valid_until": "2026-06-16T17:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T16:45:05.885Z",
      "x_nadsec_last_seen": "2026-05-15T16:52:09.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-15T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:05:05.000Z",
      "valid_until": "2026-06-16T17:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T16:18:25.000Z",
      "x_nadsec_last_seen": "2026-05-23T14:53:33.452Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-15T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--fbd1469f-271a-4e9b-abce-eb1ee752e443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:05:05.000Z",
      "valid_until": "2026-06-16T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T16:28:58.186Z",
      "x_nadsec_last_seen": "2026-05-15T16:28:58.186Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-15T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--08983151-4897-427f-8312-fba9e060fc72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:05:05.000Z",
      "valid_until": "2026-06-16T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T16:28:58.539Z",
      "x_nadsec_last_seen": "2026-05-15T16:28:58.539Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--ba8af91e-71bb-4762-b4b1-bcde2f80f991",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.13.16.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-15T17:51:44.458Z",
      "x_nadsec_last_seen": "2026-05-31T14:00:30.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9928991f-8341-4bdd-bc54-8ec89550fdc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.97.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T17:10:11.296Z",
      "x_nadsec_last_seen": "2026-05-15T17:10:14.972Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=25620; asn_org=COTAS LTDA.",
      "id": "indicator--6c88d86b-983d-4eb1-96e1-b18ee893a82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.186.32.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T17:44:19.154Z",
      "x_nadsec_last_seen": "2026-05-15T17:46:26.372Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "25620"
      ],
      "x_nadsec_orgs": [
        "COTAS LTDA."
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NZ; asn=4771; asn_org=Spark New Zealand Trading Ltd.",
      "id": "indicator--1ca6c230-8f42-4a7c-aff9-5615f053a4a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '219.88.71.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T17:56:25.708Z",
      "x_nadsec_last_seen": "2026-05-15T17:58:29.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NZ"
      ],
      "x_nadsec_asns": [
        "4771"
      ],
      "x_nadsec_orgs": [
        "Spark New Zealand Trading Ltd."
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--7be7aaeb-4953-478a-896f-c6f6e0059c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.177.160.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T17:13:34.864Z",
      "x_nadsec_last_seen": "2026-05-15T17:15:39.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--4a16580f-1cd8-4b29-ac2c-c385f827e070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.195.138.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T17:07:43.661Z",
      "x_nadsec_last_seen": "2026-05-21T01:58:36.784Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=271814; asn_org=NEXTNET SAC",
      "id": "indicator--0eddf65e-6b98-471f-b1e4-9b408a525976",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.43.156.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T17:16:27.497Z",
      "x_nadsec_last_seen": "2026-05-15T17:17:43.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "271814"
      ],
      "x_nadsec_orgs": [
        "NEXTNET SAC"
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=BR; asn=268166; asn_org=POINT TELECOM SERVICOS LTDA",
      "id": "indicator--3d66c89d-e9ca-4b77-a3fb-262d1a281655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.170.181.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-15T17:12:52.806Z",
      "x_nadsec_last_seen": "2026-05-15T17:15:25.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268166"
      ],
      "x_nadsec_orgs": [
        "POINT TELECOM SERVICOS LTDA"
      ]
    },
    {
      "created": "2026-05-15T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DE; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--46390b48-03b7-4ea9-b7c0-a1f083813c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.249.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T18:05:11.000Z",
      "valid_until": "2026-06-16T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T17:09:56.798Z",
      "x_nadsec_last_seen": "2026-05-15T17:09:56.798Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KZ; asn=29355; asn_org=Kcell JSC",
      "id": "indicator--b2d7d513-ac8b-4bd5-b0b9-4a513621c676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.27.131.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T19:02:49.528Z",
      "x_nadsec_last_seen": "2026-05-15T19:10:12.033Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "29355"
      ],
      "x_nadsec_orgs": [
        "Kcell JSC"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=468; services=smbd; ports=445; cc=ZM; asn=37532; asn_org=ZAMREN",
      "id": "indicator--4bc8d169-46e7-46a0-bd94-ab17e9a24b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.0.229.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 468,
      "x_nadsec_first_seen": "2026-05-15T18:37:21.418Z",
      "x_nadsec_last_seen": "2026-05-15T18:55:08.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZM"
      ],
      "x_nadsec_asns": [
        "37532"
      ],
      "x_nadsec_orgs": [
        "ZAMREN"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c258f1b3-57f6-4e31-af2e-85f71c17308c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.252.24.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T18:54:40.360Z",
      "x_nadsec_last_seen": "2026-05-15T19:10:26.244Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-15T18:08:26.118Z",
      "x_nadsec_last_seen": "2026-05-27T15:03:09.025Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--997066cf-8fb7-469d-bceb-d006ef36560a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.232.140.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T18:55:46.946Z",
      "x_nadsec_last_seen": "2026-05-15T18:57:52.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T18:55:47.608Z",
      "x_nadsec_last_seen": "2026-05-15T18:55:47.608Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--05077b0f-4178-4db5-88d4-7eba40036c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T18:56:40.968Z",
      "x_nadsec_last_seen": "2026-05-15T18:56:40.968Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4d74e957-d5af-401e-9589-4e3cf2a769a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T18:44:50.000Z",
      "x_nadsec_last_seen": "2026-05-15T18:44:50.000Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T19:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T19:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T19:05:14.000Z",
      "valid_until": "2026-06-16T19:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T18:06:47.072Z",
      "x_nadsec_last_seen": "2026-05-15T18:06:47.072Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--3d9fb7bb-5599-4791-aa4f-650a62ecf135",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.109.163.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:28.665Z",
      "x_nadsec_last_seen": "2026-05-15T19:51:39.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=24173; asn_org=Netnam Company",
      "id": "indicator--af2a217a-6ab0-4943-a3c3-0fae304166ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.96.67.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:36:12.187Z",
      "x_nadsec_last_seen": "2026-05-15T19:52:44.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24173"
      ],
      "x_nadsec_orgs": [
        "Netnam Company"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=56254; asn_org=UNIVERSITAS RIAU",
      "id": "indicator--6d56fbf5-0659-4832-8ef6-de5b1503429f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.10.169.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:43.948Z",
      "x_nadsec_last_seen": "2026-05-15T19:52:47.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "56254"
      ],
      "x_nadsec_orgs": [
        "UNIVERSITAS RIAU"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58369; asn_org=PT. Fiber Networks Indonesia",
      "id": "indicator--ba5b6bc2-0c71-4a49-b220-6f714099056f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.159.221.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T20:04:16.614Z",
      "x_nadsec_last_seen": "2026-05-15T20:04:27.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58369"
      ],
      "x_nadsec_orgs": [
        "PT. Fiber Networks Indonesia"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=133623; asn_org=Planet Cable Inc.",
      "id": "indicator--c31517a5-a0cd-4aff-905b-71e549da0f53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.36.16.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T19:20:51.735Z",
      "x_nadsec_last_seen": "2026-05-15T19:22:56.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "133623"
      ],
      "x_nadsec_orgs": [
        "Planet Cable Inc."
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--c4caa96b-87d8-4b9c-98ca-cd7b29781769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T19:40:06.321Z",
      "x_nadsec_last_seen": "2026-05-24T09:58:48.841Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--429e2ab3-5f74-4ea2-9c4f-2f74ef04f213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.163.150.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:12.420Z",
      "x_nadsec_last_seen": "2026-05-15T19:46:31.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f9c6c815-4af4-4134-ba84-82b2a24be8a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.176.108.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:00.073Z",
      "x_nadsec_last_seen": "2026-05-15T19:46:16.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b5e0edc4-364b-460a-99d6-cc876c6ea9f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.179.55.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:34:56.953Z",
      "x_nadsec_last_seen": "2026-05-15T19:46:17.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3e91adc7-687e-465c-91a8-6db485dc50a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.180.29.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:13.356Z",
      "x_nadsec_last_seen": "2026-05-15T19:46:31.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--f6a3549c-2c4b-4e2e-9942-ab4c1fe97d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.79.88.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:23.577Z",
      "x_nadsec_last_seen": "2026-05-15T19:50:51.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--e80e0a87-bf75-4bec-8fb7-c97a864714bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.2.32.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:42:01.194Z",
      "x_nadsec_last_seen": "2026-05-15T19:58:08.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--e89449ce-fc89-41a2-87c1-2b72c3da6108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.176.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:47.286Z",
      "x_nadsec_last_seen": "2026-05-15T19:51:32.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4bf89e7d-ef13-4631-ae87-bda881bff5f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.124.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T19:35:06.231Z",
      "x_nadsec_last_seen": "2026-05-15T19:35:06.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1d508daa-099c-4e06-a759-c85a7a10e41a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.204.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:34:51.218Z",
      "x_nadsec_last_seen": "2026-05-15T19:46:06.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--121d0245-166e-4cb2-a9e8-8913d92a9a90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.140.185.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:55.399Z",
      "x_nadsec_last_seen": "2026-05-15T19:51:44.707Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8a914fe4-48a1-4b81-9285-d612ea3f5d76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.244.81.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:35.306Z",
      "x_nadsec_last_seen": "2026-05-15T19:50:39.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8299bb53-ce42-47c9-a711-e9fcf35acd21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.174.235.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T19:35:56.360Z",
      "x_nadsec_last_seen": "2026-05-15T19:35:56.360Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4b1ffed0-6b77-4b9f-bc56-1b3fd6d099aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.245.96.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:55.760Z",
      "x_nadsec_last_seen": "2026-05-15T19:52:11.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--afe41872-6679-4a6a-80cc-4076e199e492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.49.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T19:10:44.084Z",
      "x_nadsec_last_seen": "2026-05-15T19:10:44.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=55685; asn_org=PT Jala Lintas Media",
      "id": "indicator--e47095de-8265-4d3e-bb45-1050dd2fd095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.145.11.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:39.648Z",
      "x_nadsec_last_seen": "2026-05-15T19:51:19.004Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55685"
      ],
      "x_nadsec_orgs": [
        "PT Jala Lintas Media"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--43dcf991-0216-485d-b1c0-fe3a6892f966",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T19:35:48.418Z",
      "x_nadsec_last_seen": "2026-05-15T19:35:48.418Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--436995d2-f9ec-408c-96a3-a689ae1bac59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.124.88.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T19:48:16.769Z",
      "x_nadsec_last_seen": "2026-05-15T20:04:15.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--30117e76-1062-47b0-89e2-872007bb9951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.67.108.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:19.719Z",
      "x_nadsec_last_seen": "2026-05-15T19:51:04.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--134ceb22-0e18-4e57-8f09-9c6792f33031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.89.62.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:20.901Z",
      "x_nadsec_last_seen": "2026-05-15T19:50:59.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MA; asn=36903; asn_org=MT-MPLS",
      "id": "indicator--ec11fec5-b6f4-4b40-a8ee-0082f09399a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.142.118.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T20:02:36.245Z",
      "x_nadsec_last_seen": "2026-05-15T20:04:42.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=149746; asn_org=PT Blip Integrator Provider",
      "id": "indicator--18dcc17c-713e-4f22-b93a-37d4abd88ee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.252.158.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-15T19:35:27.118Z",
      "x_nadsec_last_seen": "2026-05-15T19:51:04.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "149746"
      ],
      "x_nadsec_orgs": [
        "PT Blip Integrator Provider"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--611559d7-3720-43c9-8b52-9cd4c6f0e976",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.41.11.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T19:37:19.630Z",
      "x_nadsec_last_seen": "2026-05-15T19:39:27.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-15T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--f5dc3b03-d4e9-4f6e-9440-262d9e280b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.38.132.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:05:10.000Z",
      "valid_until": "2026-06-16T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T19:49:05.968Z",
      "x_nadsec_last_seen": "2026-05-15T19:51:15.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "58224"
      ],
      "x_nadsec_orgs": [
        "Iran Telecommunication Company PJS"
      ]
    },
    {
      "created": "2026-05-15T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7b36a8cb-90e0-414c-af4f-15a6f84d9935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.48.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:05:10.000Z",
      "valid_until": "2026-06-16T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T20:37:22.181Z",
      "x_nadsec_last_seen": "2026-05-15T20:37:34.704Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-15T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=12389; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--73dc8510-a202-411e-8e44-1c3bdb00fb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.119.185.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:05:10.000Z",
      "valid_until": "2026-06-16T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T20:53:08.292Z",
      "x_nadsec_last_seen": "2026-05-15T23:01:13.308Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--58abbaeb-5104-41fa-a1e0-8447ef6b0fd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.197.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:05:10.000Z",
      "valid_until": "2026-06-16T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T20:37:35.808Z",
      "x_nadsec_last_seen": "2026-05-16T13:14:32.458Z",
      "x_nadsec_ports": [
        "1883",
        "1433"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-15T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--3c895926-bd06-4965-b357-2a4c75b72441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:05:10.000Z",
      "valid_until": "2026-06-16T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T20:29:54.951Z",
      "x_nadsec_last_seen": "2026-05-26T08:38:06.400Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f2a39d85-b2c5-4e05-81ef-cd028d67959b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.39.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-15T21:35:00.697Z",
      "x_nadsec_last_seen": "2026-05-30T10:34:47.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=58519; asn_org=Cloud Computing Corporation; user(top)=**; pass(top)=***",
      "id": "indicator--b1fc771b-2474-4e27-8ee6-8971f216bce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '140.246.235.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T21:17:09.650Z",
      "x_nadsec_last_seen": "2026-05-15T21:17:09.650Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58519"
      ],
      "x_nadsec_orgs": [
        "Cloud Computing Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--fa251aaf-ac6b-4fc8-a0e0-14afe4021617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.65.40.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T21:19:56.397Z",
      "x_nadsec_last_seen": "2026-05-15T21:19:56.397Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--626ac04a-a1d7-4f0c-9e4a-72af6f722cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.48.203.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-12T12:02:07.894Z",
      "x_nadsec_last_seen": "2026-05-15T21:53:49.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--ecdf515d-a3f5-4dce-93b4-82f8937a01c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T21:30:29.686Z",
      "x_nadsec_last_seen": "2026-05-15T21:30:29.686Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--6cdc1504-529c-4ace-b626-6e431a377a32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.140.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-15T21:14:45.595Z",
      "x_nadsec_last_seen": "2026-05-15T21:15:09.148Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--520b6b72-8dde-4368-a297-99e77279b408",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.244.207.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-15T21:20:41.100Z",
      "x_nadsec_last_seen": "2026-05-15T21:27:59.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-05-15T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--f35b5b34-4314-4cc7-826c-06c9bfd8df5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.57.227.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:05:10.000Z",
      "valid_until": "2026-06-16T22:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-15T21:29:56.553Z",
      "x_nadsec_last_seen": "2026-05-18T10:53:11.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-15T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d09a28c7-e212-4a93-89e0-3cf11ed0d856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.248.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:05:10.000Z",
      "valid_until": "2026-06-16T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T22:06:05.672Z",
      "x_nadsec_last_seen": "2026-05-15T22:06:05.672Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-15T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--46db8633-34a9-4b11-9ee4-2e5c1ac55cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-15T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:05:10.000Z",
      "valid_until": "2026-06-16T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-15T22:58:08.521Z",
      "x_nadsec_last_seen": "2026-05-15T22:58:08.521Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c323b4ea-6f50-4b8e-aaac-eb1384cd8862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.254.8.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:05:11.000Z",
      "valid_until": "2026-06-17T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-15T23:37:49.693Z",
      "x_nadsec_last_seen": "2026-05-15T23:39:56.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-16T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6b159607-f629-4c32-aa4e-1ba968a950ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.52.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:05:18.000Z",
      "valid_until": "2026-06-17T01:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-16T00:21:33.412Z",
      "x_nadsec_last_seen": "2026-05-31T03:25:06.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f2425490-8f27-446c-972f-2ef9642685de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.30.249.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:05:18.000Z",
      "valid_until": "2026-06-17T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T00:54:07.425Z",
      "x_nadsec_last_seen": "2026-05-16T00:54:08.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--7dbf7f09-5da7-4326-8cfa-187c74148f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.237.207.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:05:18.000Z",
      "valid_until": "2026-06-17T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T00:34:14.439Z",
      "x_nadsec_last_seen": "2026-05-16T00:39:40.901Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-16T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--835efc11-c07a-4ca4-a78d-992b454e55b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.60.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:05:18.000Z",
      "valid_until": "2026-06-17T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T00:28:55.258Z",
      "x_nadsec_last_seen": "2026-05-21T18:37:43.272Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=SG; asn=9506; asn_org=Singtel Fibre Broadband; user(top)=**",
      "id": "indicator--0bc85eec-9f23-485e-a392-6b0fe96e0652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '219.74.254.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:05:18.000Z",
      "valid_until": "2026-06-17T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T00:16:01.301Z",
      "x_nadsec_last_seen": "2026-05-16T00:16:01.738Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "9506"
      ],
      "x_nadsec_orgs": [
        "Singtel Fibre Broadband"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-16T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--2ccd88bf-d342-4f8e-b8ff-e0b1f766f1ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.14.117.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:05:18.000Z",
      "valid_until": "2026-06-17T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T00:13:14.373Z",
      "x_nadsec_last_seen": "2026-05-25T08:55:45.060Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T01:05:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--639054b0-6311-4972-99ba-58cddde6697f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T01:05:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.227.40.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:05:18.000Z",
      "valid_until": "2026-06-17T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T00:56:55.727Z",
      "x_nadsec_last_seen": "2026-05-16T00:56:55.727Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--6578d392-6e60-43ec-bcc4-e6997287bdd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.185.107.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-14T11:02:41.978Z",
      "x_nadsec_last_seen": "2026-05-22T23:56:19.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--ec5180c6-cbe2-474d-a771-ed1840a91cbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.156.228.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T01:12:55.690Z",
      "x_nadsec_last_seen": "2026-05-16T01:12:55.690Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--109bdf3a-66d8-4fd9-8ed9-e403948e37c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.119.112.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T01:14:16.266Z",
      "x_nadsec_last_seen": "2026-05-16T01:14:16.629Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--83657cae-b47a-4dac-a9cf-438f10d30e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.195.144.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T02:02:58.658Z",
      "x_nadsec_last_seen": "2026-05-16T02:02:58.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--ad8f4715-2a79-4c0e-90f8-59a877f97022",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.99.190.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T01:28:31.960Z",
      "x_nadsec_last_seen": "2026-05-16T01:28:32.219Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c0f6fadd-94aa-4976-9a28-092669d5db4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T01:36:49.908Z",
      "x_nadsec_last_seen": "2026-05-16T01:36:49.908Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--164e8045-ccc3-4acf-8fb4-877d9b4c069a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.174.236.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T01:25:16.139Z",
      "x_nadsec_last_seen": "2026-05-16T01:25:26.346Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--f2eba859-9861-4111-90e0-203cb0e9d434",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.74.51.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T01:28:36.150Z",
      "x_nadsec_last_seen": "2026-05-16T01:28:36.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T01:27:10.193Z",
      "x_nadsec_last_seen": "2026-05-29T21:30:36.496Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--bf82920b-8b82-43ac-9d9a-6b23ba790a25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.61.91.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T01:33:00.606Z",
      "x_nadsec_last_seen": "2026-05-16T01:39:32.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--eda8f56c-2e9f-4ea1-a7de-2515c795520e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.49.72.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-16T01:38:38.558Z",
      "x_nadsec_last_seen": "2026-05-25T14:33:48.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b212f231-6004-4ce0-9b16-4cfe1ad9f0df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.230.93.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-16T01:36:50.170Z",
      "x_nadsec_last_seen": "2026-05-16T02:06:12.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-16T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=17483; asn_org=CityOnline Services Ltd",
      "id": "indicator--e881cbcc-2c07-4a67-a7e3-eff691be39f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.156.146.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:05:10.000Z",
      "valid_until": "2026-06-17T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T02:00:54.399Z",
      "x_nadsec_last_seen": "2026-05-16T02:02:59.966Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17483"
      ],
      "x_nadsec_orgs": [
        "CityOnline Services Ltd"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--01bec2a0-4b23-4811-90b1-88fb84d594b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.118.205.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T02:38:39.525Z",
      "x_nadsec_last_seen": "2026-05-16T02:40:41.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dd5ea02b-7be1-4c38-8afe-f4b05a28caf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.162.247.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T02:37:58.920Z",
      "x_nadsec_last_seen": "2026-05-16T02:40:03.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9a5ca433-7b46-4934-9718-ad3081343e5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.230.163.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T02:45:50.320Z",
      "x_nadsec_last_seen": "2026-05-16T02:47:55.110Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a92de739-157a-408c-bde3-f765932b0025",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.80.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T02:45:51.639Z",
      "x_nadsec_last_seen": "2026-05-16T02:45:51.639Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ZA; asn=327901; asn_org=Level7-AS",
      "id": "indicator--bf7520aa-a1ea-4dfe-92aa-be0eb5caf6d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '169.255.196.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-16T02:08:01.919Z",
      "x_nadsec_last_seen": "2026-05-16T02:11:32.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327901"
      ],
      "x_nadsec_orgs": [
        "Level7-AS"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=39; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e15e1aef-1c2f-4b6d-bd58-74774ee186a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.14.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 39,
      "x_nadsec_first_seen": "2026-05-16T02:48:49.546Z",
      "x_nadsec_last_seen": "2026-05-16T02:49:09.306Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--81757e06-d61d-4977-9fcf-2008dfb417a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-16T02:45:52.670Z",
      "x_nadsec_last_seen": "2026-05-16T02:46:08.139Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2488109a-a549-45e3-b1fb-8dd69a325d1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T02:38:51.433Z",
      "x_nadsec_last_seen": "2026-05-16T02:38:51.433Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--d85fc885-c7e7-4d3b-ad40-ec40a7aa1d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T02:29:30.881Z",
      "x_nadsec_last_seen": "2026-05-16T02:29:30.881Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--df776ede-e287-4408-ad8c-6a064c63244e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-16T02:50:09.290Z",
      "x_nadsec_last_seen": "2026-05-16T02:50:29.064Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--88f64569-a5f7-4798-9c37-4a0f360015c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.234.10.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-16T02:57:35.953Z",
      "x_nadsec_last_seen": "2026-05-29T07:30:20.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-05-16T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1c37b94b-2853-431d-81d0-f5bb9ed6edb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.226.214.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:05:10.000Z",
      "valid_until": "2026-06-17T03:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-16T02:52:21.986Z",
      "x_nadsec_last_seen": "2026-05-16T03:05:02.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--0a18f7d6-6f49-49a3-9b97-bd9e253f0c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.193.160.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:05:10.000Z",
      "valid_until": "2026-06-17T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T03:50:19.696Z",
      "x_nadsec_last_seen": "2026-05-16T03:50:19.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--f82c2209-539e-42a3-8cda-0f82bbc3ce94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.132.103.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:05:10.000Z",
      "valid_until": "2026-06-17T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T03:08:27.998Z",
      "x_nadsec_last_seen": "2026-05-16T03:10:34.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-05-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--98c85f96-9b85-4949-9512-9681dd2b382a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:05:10.000Z",
      "valid_until": "2026-06-17T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T03:32:45.500Z",
      "x_nadsec_last_seen": "2026-05-31T11:33:37.050Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-16T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7e77a6eb-39ca-4d97-9074-1e4bb60a2b16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.241.220.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:05:10.000Z",
      "valid_until": "2026-06-17T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T03:59:26.269Z",
      "x_nadsec_last_seen": "2026-05-16T04:07:47.752Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--345e6bb4-69ea-4378-b515-d4910e5de687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.199.81.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T04:19:52.186Z",
      "x_nadsec_last_seen": "2026-05-16T04:20:31.773Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b801ae31-3c56-4b8e-9580-fe4ea1891e78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.41.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T04:27:54.788Z",
      "x_nadsec_last_seen": "2026-05-16T04:29:59.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ebd3b035-3ae3-4766-bd26-224873c18378",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.1.46.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T04:26:40.018Z",
      "x_nadsec_last_seen": "2026-05-16T04:27:00.195Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9d8e6494-cf67-400d-94c3-7b2f338f783e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.148.31.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T04:18:43.555Z",
      "x_nadsec_last_seen": "2026-05-16T04:18:43.555Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--47d77735-09ea-45fe-8f22-912e64f66943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.179.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T05:04:12.692Z",
      "x_nadsec_last_seen": "2026-05-16T05:04:12.692Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--de509441-f9a8-42cf-a9f7-827436dc94b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.5.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T05:04:13.951Z",
      "x_nadsec_last_seen": "2026-05-16T05:04:13.951Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0b2c4ce9-fd46-4af7-83c3-a9599ea8f0dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.31.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T05:04:13.660Z",
      "x_nadsec_last_seen": "2026-05-16T05:04:13.660Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d4acf898-a29f-468e-be7a-8b7d56d335df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.241.35.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T04:09:55.340Z",
      "x_nadsec_last_seen": "2026-05-16T04:16:26.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=51622; asn_org=PP IV-COM",
      "id": "indicator--6ea4cdd6-a3b2-46fa-b1ba-7420cab7607e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.162.70.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T04:49:30.930Z",
      "x_nadsec_last_seen": "2026-05-16T04:51:37.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "51622"
      ],
      "x_nadsec_orgs": [
        "PP IV-COM"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T04:30:29.150Z",
      "x_nadsec_last_seen": "2026-05-16T04:30:29.150Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f2737a3f-0b49-4028-b557-b1aae9d5519d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T04:25:03.659Z",
      "x_nadsec_last_seen": "2026-05-16T04:25:03.659Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-16T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--694e5726-f924-4d5a-a7e1-840e71ec06f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:05:10.000Z",
      "valid_until": "2026-06-17T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T05:02:31.046Z",
      "x_nadsec_last_seen": "2026-05-16T05:02:31.046Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-16T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--13fbfa60-3ebb-484d-b955-30d8d787f131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.167.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:05:10.000Z",
      "valid_until": "2026-06-17T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T06:00:33.416Z",
      "x_nadsec_last_seen": "2026-05-16T06:00:38.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=55699; asn_org=PT. Cemerlang Multimedia",
      "id": "indicator--0214c346-cdbe-45fc-bbf8-61c79dc01457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.210.84.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:05:10.000Z",
      "valid_until": "2026-06-17T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T05:31:49.002Z",
      "x_nadsec_last_seen": "2026-05-16T05:33:53.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55699"
      ],
      "x_nadsec_orgs": [
        "PT. Cemerlang Multimedia"
      ]
    },
    {
      "created": "2026-05-16T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:05:10.000Z",
      "valid_until": "2026-06-17T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T05:46:31.600Z",
      "x_nadsec_last_seen": "2026-05-20T13:41:20.782Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--3d6385ff-8aa2-4d2a-980c-d7e9fb6d08fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:05:12.000Z",
      "valid_until": "2026-06-17T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T06:35:58.886Z",
      "x_nadsec_last_seen": "2026-05-16T06:38:05.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f124d58f-06b1-457d-9baa-c4e949fdd2ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.46.244.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:05:12.000Z",
      "valid_until": "2026-06-17T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T06:09:56.231Z",
      "x_nadsec_last_seen": "2026-05-16T06:09:56.581Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17771; asn_org=Southern Online Bio Technologies Ltd",
      "id": "indicator--6744e9cd-8dae-45b3-86cb-e9d6eae0435f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.63.106.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:05:12.000Z",
      "valid_until": "2026-06-17T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T06:26:21.312Z",
      "x_nadsec_last_seen": "2026-05-16T06:32:44.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17771"
      ],
      "x_nadsec_orgs": [
        "Southern Online Bio Technologies Ltd"
      ]
    },
    {
      "created": "2026-05-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--731bdb5c-9b99-4fa8-a378-73d7cd721c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.210.240.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:05:12.000Z",
      "valid_until": "2026-06-17T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T06:11:00.008Z",
      "x_nadsec_last_seen": "2026-05-16T06:13:04.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T07:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--df51a2e0-ebed-4e0e-82d0-aa9f82a085f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T07:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.145.185.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:05:12.000Z",
      "valid_until": "2026-06-17T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T06:56:42.524Z",
      "x_nadsec_last_seen": "2026-05-16T06:56:47.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e894da66-c564-4dbd-8191-67174a6b9f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.96.200.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:05:12.000Z",
      "valid_until": "2026-06-17T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T07:18:28.203Z",
      "x_nadsec_last_seen": "2026-05-16T07:20:33.634Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bf81d47e-fbf7-4d71-80c5-972d2981ddae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.251.155.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:05:12.000Z",
      "valid_until": "2026-06-17T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T07:21:17.097Z",
      "x_nadsec_last_seen": "2026-05-16T07:23:22.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=142; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--af3eae22-4d9b-4e0f-8764-67cf5c4243fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:05:12.000Z",
      "valid_until": "2026-06-17T08:05:09.000Z",
      "x_nadsec_event_count": 142,
      "x_nadsec_first_seen": "2026-05-16T07:14:48.595Z",
      "x_nadsec_last_seen": "2026-05-16T07:56:48.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-05-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8595; asn_org=OOO WestCall Ltd.",
      "id": "indicator--07d7a2ca-0ab6-4cad-8b8f-a06d00fc1420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.246.181.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:05:12.000Z",
      "valid_until": "2026-06-17T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T07:57:12.149Z",
      "x_nadsec_last_seen": "2026-05-16T08:03:37.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8595"
      ],
      "x_nadsec_orgs": [
        "OOO WestCall Ltd."
      ]
    },
    {
      "created": "2026-05-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--628f7581-c14b-4d14-98ee-cd2778d37e9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.246.51.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:05:12.000Z",
      "valid_until": "2026-06-17T08:05:09.000Z",
      "x_nadsec_event_count": 3152,
      "x_nadsec_first_seen": "2026-05-16T08:00:30.609Z",
      "x_nadsec_last_seen": "2026-05-16T13:31:57.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-16T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--0bb73a4f-8d71-4b58-b3d1-da36de3e0cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.113.118.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T08:05:12.000Z",
      "valid_until": "2026-06-17T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T07:17:14.554Z",
      "x_nadsec_last_seen": "2026-05-16T07:24:45.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-16T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fd2912a7-9c61-4594-92fd-00ccb6858c44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.242.32.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T09:05:10.000Z",
      "valid_until": "2026-06-17T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T08:20:04.322Z",
      "x_nadsec_last_seen": "2026-05-16T08:26:51.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-16T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=UA; asn=35297; asn_org=Dataline LLC",
      "id": "indicator--091df05f-275f-4dfa-99ef-5c8416ac20cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.251.110.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T09:05:10.000Z",
      "valid_until": "2026-06-17T09:05:09.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-05-16T08:57:54.773Z",
      "x_nadsec_last_seen": "2026-05-16T11:49:17.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "35297"
      ],
      "x_nadsec_orgs": [
        "Dataline LLC"
      ]
    },
    {
      "created": "2026-05-16T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--7dad1dbc-3f51-46b7-aca1-c6945f7bf0b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.95.68.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T09:05:10.000Z",
      "valid_until": "2026-06-17T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T08:34:08.339Z",
      "x_nadsec_last_seen": "2026-05-16T08:36:12.699Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--591a72ee-dd51-4934-9ce5-4a09617d203c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.180.146.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T09:05:10.000Z",
      "valid_until": "2026-06-17T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T08:19:40.698Z",
      "x_nadsec_last_seen": "2026-05-16T08:19:41.049Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--84d50f47-1248-41b8-a4ca-0b48b1402f61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.219.1.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:05:05.000Z",
      "valid_until": "2026-06-17T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T09:52:50.692Z",
      "x_nadsec_last_seen": "2026-05-16T09:52:50.692Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-16T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a7578eff-b769-48a0-9480-e1f2f1a5e2ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:05:05.000Z",
      "valid_until": "2026-06-17T10:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T09:49:57.811Z",
      "x_nadsec_last_seen": "2026-05-20T23:26:12.421Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-16T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8e0b10a0-b17c-4b02-9417-118d13dd29c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:05:05.000Z",
      "valid_until": "2026-06-17T10:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T09:49:57.392Z",
      "x_nadsec_last_seen": "2026-05-20T23:26:45.671Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-16T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d7d1ccc4-b7a2-43fd-8c57-501e2788660e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:05:05.000Z",
      "valid_until": "2026-06-17T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T09:50:25.901Z",
      "x_nadsec_last_seen": "2026-05-16T09:50:25.901Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-16T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--6b71fe42-6c43-40f4-ba23-b869f067abcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.81.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:05:05.000Z",
      "valid_until": "2026-06-17T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T09:45:45.041Z",
      "x_nadsec_last_seen": "2026-05-16T09:45:45.041Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.170.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-16T10:09:56.877Z",
      "x_nadsec_last_seen": "2026-05-16T10:14:03.449Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134540; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--4a59ff72-6136-4bb1-9161-a8d6de81b1a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.96.81.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T10:41:12.270Z",
      "x_nadsec_last_seen": "2026-05-16T10:43:17.411Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134540"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--32bc6504-e846-4216-ae19-f9478e19c059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.50.203.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T10:50:54.368Z",
      "x_nadsec_last_seen": "2026-05-16T10:53:01.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--17e61173-085e-46be-89e2-5331da55b4ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.132.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T10:14:54.023Z",
      "x_nadsec_last_seen": "2026-05-16T10:14:54.023Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--1dfa7362-a503-4425-bd55-5e27cb91c17a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.120.85.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T10:58:37.092Z",
      "x_nadsec_last_seen": "2026-05-16T11:00:44.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--958e6ec7-b30b-4ac7-973c-dd43141f13a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.21.152.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T10:38:16.780Z",
      "x_nadsec_last_seen": "2026-05-16T10:43:42.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=52413; asn_org=MADACOM SRL",
      "id": "indicator--f8641fb7-9131-45f2-a8f1-46c70a964323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.220.23.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T10:41:31.969Z",
      "x_nadsec_last_seen": "2026-05-16T10:41:38.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52413"
      ],
      "x_nadsec_orgs": [
        "MADACOM SRL"
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bd3cc4c4-c4d9-4b63-9621-29046a1339df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.83.142.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T10:38:06.691Z",
      "x_nadsec_last_seen": "2026-05-16T10:44:24.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--18b4d64b-c946-418c-bae9-a102d25119cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T10:21:32.881Z",
      "x_nadsec_last_seen": "2026-05-16T10:21:32.881Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-16T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--11437c3d-5c27-47f2-bf19-40266364f3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.185.163.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:05:05.000Z",
      "valid_until": "2026-06-17T11:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T10:28:54.477Z",
      "x_nadsec_last_seen": "2026-05-16T10:35:56.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--c44b5963-ce09-4534-ab5e-d1aa3308c88a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.106.67.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T11:11:44.135Z",
      "x_nadsec_last_seen": "2026-05-16T11:11:44.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=10118; asn_org=Hutchison Telephone Company Limited",
      "id": "indicator--9c7787c5-cd7c-40ae-a96b-850cc9392d3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.217.188.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T12:00:21.032Z",
      "x_nadsec_last_seen": "2026-05-16T12:07:25.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "10118"
      ],
      "x_nadsec_orgs": [
        "Hutchison Telephone Company Limited"
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--f6a6be55-9cad-4fa8-b24c-097172ff2bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.135.128.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T11:08:54.953Z",
      "x_nadsec_last_seen": "2026-05-16T11:12:09.539Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=MN; asn=45204; asn_org=GEMNET LLC",
      "id": "indicator--22d6e4b8-565a-4b96-9d65-39d02822e395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T11:12:54.372Z",
      "x_nadsec_last_seen": "2026-05-16T11:12:54.372Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "45204"
      ],
      "x_nadsec_orgs": [
        "GEMNET LLC"
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=17222; asn_org=MUNDIVOX DO BRASIL LTDA",
      "id": "indicator--ed87fd99-80b7-4e6c-bc84-6f6ad16e494c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.102.157.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T11:33:58.192Z",
      "x_nadsec_last_seen": "2026-05-16T11:36:05.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "17222"
      ],
      "x_nadsec_orgs": [
        "MUNDIVOX DO BRASIL LTDA"
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--20da7bb5-6118-4c64-8fc7-bb3a9638ec31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.119.222.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T11:40:54.921Z",
      "x_nadsec_last_seen": "2026-05-16T11:45:46.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5fe5535c-49ed-4a05-a297-58debb5f8d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T11:35:24.649Z",
      "x_nadsec_last_seen": "2026-05-26T09:44:20.530Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-16T11:16:40.427Z",
      "x_nadsec_last_seen": "2026-05-24T11:02:55.361Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-16T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--28d65b6d-52b8-4d3e-b92e-f01f5cac77d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.85.241.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T12:05:10.000Z",
      "valid_until": "2026-06-17T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T11:50:05.019Z",
      "x_nadsec_last_seen": "2026-05-16T11:52:12.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133711; asn_org=Home Broadband Services LLP",
      "id": "indicator--beb7e1f8-b4f0-4b68-94c6-5cae7123a928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.47.17.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T12:39:52.131Z",
      "x_nadsec_last_seen": "2026-05-16T12:47:45.562Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133711"
      ],
      "x_nadsec_orgs": [
        "Home Broadband Services LLP"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=133711; asn_org=Home Broadband Services LLP",
      "id": "indicator--57afc9e5-ca15-4bf4-ba65-9bbddc1126e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.47.17.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T12:45:40.918Z",
      "x_nadsec_last_seen": "2026-05-16T12:45:40.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133711"
      ],
      "x_nadsec_orgs": [
        "Home Broadband Services LLP"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=133711; asn_org=Home Broadband Services LLP",
      "id": "indicator--38897cab-b34f-4acc-810a-988adea5a5d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.47.17.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T12:47:46.622Z",
      "x_nadsec_last_seen": "2026-05-16T12:47:46.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133711"
      ],
      "x_nadsec_orgs": [
        "Home Broadband Services LLP"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--97bbeee5-229f-467a-8afe-d703b2e8258b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.133.209.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T12:23:51.632Z",
      "x_nadsec_last_seen": "2026-05-16T12:23:51.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e0e0d1b5-230d-4942-b5d4-926db364d37b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.166.232.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T12:55:39.065Z",
      "x_nadsec_last_seen": "2026-05-16T12:57:43.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--16e28421-c0c9-49d2-964f-b37478957381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.172.81.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T12:45:14.828Z",
      "x_nadsec_last_seen": "2026-05-16T12:47:19.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f71ad4ff-6896-48dd-ae1d-d663f2d2f853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.175.57.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T13:04:27.023Z",
      "x_nadsec_last_seen": "2026-05-16T13:11:32.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--817c332f-b582-4916-8bd7-c9dd5aca62a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.180.143.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T12:14:42.994Z",
      "x_nadsec_last_seen": "2026-05-16T12:16:49.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--34cb6591-07fc-4ccb-b0f7-fc38eb12e825",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T12:25:57.370Z",
      "x_nadsec_last_seen": "2026-05-16T12:28:09.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T16:46:37.392Z",
      "x_nadsec_last_seen": "2026-05-21T10:01:44.082Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--308f03bc-fcc5-45ac-a39a-d3c91b2764ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.40.51.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-05-16T12:25:38.928Z",
      "x_nadsec_last_seen": "2026-05-24T02:00:40.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-16T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BG; asn=8717; asn_org=A1 Bulgaria EAD",
      "id": "indicator--4ba2c850-6ffc-4022-aada-3e1846e3d2e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.247.35.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:05:06.000Z",
      "valid_until": "2026-06-17T13:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T12:07:21.373Z",
      "x_nadsec_last_seen": "2026-05-16T12:14:21.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "8717"
      ],
      "x_nadsec_orgs": [
        "A1 Bulgaria EAD"
      ]
    },
    {
      "created": "2026-05-16T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--631d9f15-2d8f-46ed-8539-dfb7fcb3c6c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.200.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:05:05.000Z",
      "valid_until": "2026-06-17T14:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T13:14:24.730Z",
      "x_nadsec_last_seen": "2026-05-16T13:14:24.730Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-16T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5bb3d259-3679-4f9a-a13f-973d6e189560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.245.222.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:05:05.000Z",
      "valid_until": "2026-06-17T14:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T13:16:39.442Z",
      "x_nadsec_last_seen": "2026-05-16T13:18:44.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=262851; asn_org=PLIM TELECOMUNICACOES LTDA-ME",
      "id": "indicator--397a401f-c34c-490d-a02e-5c18e8a216de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.242.126.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:05:05.000Z",
      "valid_until": "2026-06-17T14:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T13:57:56.538Z",
      "x_nadsec_last_seen": "2026-05-16T14:00:03.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262851"
      ],
      "x_nadsec_orgs": [
        "PLIM TELECOMUNICACOES LTDA-ME"
      ]
    },
    {
      "created": "2026-05-16T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--46ebe052-bb50-4d55-946c-d84c477dbed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.130.196.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:05:05.000Z",
      "valid_until": "2026-06-17T14:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T14:00:22.525Z",
      "x_nadsec_last_seen": "2026-05-16T14:02:27.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-16T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--5ce549fe-625e-478c-9554-cf1ccf2015d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.62.144.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:05:05.000Z",
      "valid_until": "2026-06-17T14:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T14:04:49.742Z",
      "x_nadsec_last_seen": "2026-05-16T14:11:45.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-16T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bd64cd53-e032-45cc-aa31-dc2d3effd229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T14:05:05.000Z",
      "valid_until": "2026-06-17T14:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T13:31:26.362Z",
      "x_nadsec_last_seen": "2026-05-16T13:31:26.362Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50448; asn_org=System Service Ltd.",
      "id": "indicator--782f7401-c315-43e5-9f36-976f937d4f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.95.214.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:05:10.000Z",
      "valid_until": "2026-06-17T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T14:06:48.483Z",
      "x_nadsec_last_seen": "2026-05-16T14:06:54.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50448"
      ],
      "x_nadsec_orgs": [
        "System Service Ltd."
      ]
    },
    {
      "created": "2026-05-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6c813860-3190-4754-b418-726b1e3f3105",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.212.159.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:05:10.000Z",
      "valid_until": "2026-06-17T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T14:48:42.863Z",
      "x_nadsec_last_seen": "2026-05-16T14:50:48.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--7c385c4a-6947-4d79-9a5e-a3ed2c3602f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.104.164.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:05:10.000Z",
      "valid_until": "2026-06-17T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T14:46:22.161Z",
      "x_nadsec_last_seen": "2026-05-16T14:50:29.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--e30caab0-4961-4134-9c0f-e99ec3591a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.51.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:05:10.000Z",
      "valid_until": "2026-06-17T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T14:54:17.851Z",
      "x_nadsec_last_seen": "2026-05-16T14:54:17.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b7f73a82-b59b-47d9-87a0-28f46c100566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:05:10.000Z",
      "valid_until": "2026-06-17T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T15:03:22.577Z",
      "x_nadsec_last_seen": "2026-05-27T12:32:57.549Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--8590d888-1725-443d-918a-b6b6d19da184",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.34.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:05:10.000Z",
      "valid_until": "2026-06-17T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T14:48:06.703Z",
      "x_nadsec_last_seen": "2026-05-16T14:48:06.703Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-16T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d04ad77c-20a9-44d3-a16e-2847253bfc08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.249.184.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:05:10.000Z",
      "valid_until": "2026-06-17T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T14:16:30.705Z",
      "x_nadsec_last_seen": "2026-05-16T14:16:41.056Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=210278; asn_org=Sky Italia srl",
      "id": "indicator--ad80d2f6-17cc-4e44-9db9-1774d1e04081",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.56.131.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:05:05.000Z",
      "valid_until": "2026-06-17T16:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T15:10:12.270Z",
      "x_nadsec_last_seen": "2026-05-16T15:12:19.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "210278"
      ],
      "x_nadsec_orgs": [
        "Sky Italia srl"
      ]
    },
    {
      "created": "2026-05-16T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--bf55c224-7c18-4627-9bed-010168164dae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.4.184.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:05:05.000Z",
      "valid_until": "2026-06-17T16:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T15:16:07.580Z",
      "x_nadsec_last_seen": "2026-05-16T15:16:36.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-16T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2546d73d-5994-4ca4-a1fc-306e05fc0afb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.203.200.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:05:05.000Z",
      "valid_until": "2026-06-17T16:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T16:04:15.640Z",
      "x_nadsec_last_seen": "2026-05-16T16:04:15.640Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--9d081eb8-22df-440f-a001-f98334673863",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.87.215.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:05:05.000Z",
      "valid_until": "2026-06-17T16:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T15:34:33.613Z",
      "x_nadsec_last_seen": "2026-05-16T15:41:25.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-05-16T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=53766; asn_org=Arista Networks, Inc.",
      "id": "indicator--068dc4f0-830b-43b1-899c-f5fcca2027ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.221.31.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:05:05.000Z",
      "valid_until": "2026-06-17T16:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T15:12:59.416Z",
      "x_nadsec_last_seen": "2026-05-16T15:19:36.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "53766"
      ],
      "x_nadsec_orgs": [
        "Arista Networks, Inc."
      ]
    },
    {
      "created": "2026-05-16T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NO; asn=2116; asn_org=Globalconnect As",
      "id": "indicator--30234411-49f0-4b2a-96d7-2ef57efccaeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.118.58.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:05:05.000Z",
      "valid_until": "2026-06-17T16:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T15:46:06.772Z",
      "x_nadsec_last_seen": "2026-05-16T15:53:08.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "2116"
      ],
      "x_nadsec_orgs": [
        "Globalconnect As"
      ]
    },
    {
      "created": "2026-05-16T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9df07f32-2eb4-4603-9865-4aeb9019f5be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.233.19.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:05:05.000Z",
      "valid_until": "2026-06-17T16:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T15:48:21.237Z",
      "x_nadsec_last_seen": "2026-05-16T15:48:21.748Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mirrorc; ports=42841; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--81b653c1-112e-44fc-aa99-dc33e260595a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-16T16:25:28.890Z",
      "x_nadsec_last_seen": "2026-05-16T16:25:43.903Z",
      "x_nadsec_ports": [
        "42",
        "37241",
        "37441",
        "42841",
        "45383"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2ad998bb-c093-45ce-b393-78fbd0033027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.253.178.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T16:30:10.239Z",
      "x_nadsec_last_seen": "2026-05-16T16:32:15.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d5364081-3480-4139-9894-855b8073df55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T17:03:07.993Z",
      "x_nadsec_last_seen": "2026-05-26T22:04:01.214Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--7f20472e-38e7-41ac-8153-af9865525616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T16:33:48.353Z",
      "x_nadsec_last_seen": "2026-05-16T16:33:48.774Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--292a3d12-17dd-4f99-bcb2-034753eaa483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T16:59:08.938Z",
      "x_nadsec_last_seen": "2026-05-16T16:59:08.938Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--07452f82-e8b1-4b3f-b8b5-d3eb5c7f9484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.180.157.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T16:25:45.061Z",
      "x_nadsec_last_seen": "2026-05-16T16:25:45.061Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--69b3f1a3-ba46-40e7-b546-70100224fd0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T16:35:04.341Z",
      "x_nadsec_last_seen": "2026-05-16T16:35:04.341Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a8b7feef-c3ca-4aa5-a195-7bab96abd00e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T16:43:26.165Z",
      "x_nadsec_last_seen": "2026-05-30T17:26:26.178Z",
      "x_nadsec_ports": [
        "3306",
        "135"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0f2164f7-802d-41a8-a11d-df8956a6dd21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T16:43:26.520Z",
      "x_nadsec_last_seen": "2026-05-16T16:43:26.520Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-16T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9b1b4e6f-67ca-41da-92b5-bcf209bd6ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:05:10.000Z",
      "valid_until": "2026-06-17T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T16:43:49.172Z",
      "x_nadsec_last_seen": "2026-05-16T16:43:49.941Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED",
      "id": "indicator--2d38ddbb-02c5-4285-a139-1fc91253bd03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.87.9.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-16T17:09:09.995Z",
      "x_nadsec_last_seen": "2026-05-17T18:45:03.237Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3804c1aa-4ad0-4c2d-b2bf-0089f588bd07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.176.56.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T17:23:15.315Z",
      "x_nadsec_last_seen": "2026-05-16T17:25:20.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--46d0c2df-0638-44f1-b05a-8e2b4a38d82c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.196.153.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T17:59:17.557Z",
      "x_nadsec_last_seen": "2026-05-16T18:01:24.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6a8518b0-8f4b-4f47-8395-0c33e93d11b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.121.46.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T17:47:53.003Z",
      "x_nadsec_last_seen": "2026-05-16T17:47:53.767Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.74.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T17:54:24.142Z",
      "x_nadsec_last_seen": "2026-05-16T17:54:34.433Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1b9c1021-dff6-4f07-96f1-4485d6cc22ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.65.177.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T17:22:13.842Z",
      "x_nadsec_last_seen": "2026-05-16T17:22:13.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--82d2c8c8-df14-4e1f-a9c8-0795b0fafad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.240.224.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T17:22:14.058Z",
      "x_nadsec_last_seen": "2026-05-16T17:22:18.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e96118ce-0df1-44df-a9fa-07a791085fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.81.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T17:30:48.189Z",
      "x_nadsec_last_seen": "2026-05-16T17:31:27.758Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--5536539e-c6e5-4ee8-a140-fc0a4bf1ec67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.91.77.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T17:37:02.553Z",
      "x_nadsec_last_seen": "2026-05-16T17:37:02.553Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-16T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PL; asn=9141; asn_org=Play",
      "id": "indicator--a0eb5dea-5699-4c29-8841-5eb8fa1a3b8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.68.81.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:05:10.000Z",
      "valid_until": "2026-06-17T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T18:04:47.089Z",
      "x_nadsec_last_seen": "2026-05-16T18:06:53.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "9141"
      ],
      "x_nadsec_orgs": [
        "Play"
      ]
    },
    {
      "created": "2026-05-16T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=60849; asn_org=iLevant FZE",
      "id": "indicator--ef510344-b93d-4e30-a916-2a0370a58560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.27.116.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:05:10.000Z",
      "valid_until": "2026-06-17T19:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-16T18:25:21.144Z",
      "x_nadsec_last_seen": "2026-05-26T23:13:40.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "60849"
      ],
      "x_nadsec_orgs": [
        "iLevant FZE"
      ]
    },
    {
      "created": "2026-05-16T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=9924; asn_org=Taiwan Fixed Network, Telco and Network Service Provider.",
      "id": "indicator--f6d3ff96-feec-40f7-b58e-c724cc00bac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '219.80.117.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:05:10.000Z",
      "valid_until": "2026-06-17T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T18:12:23.923Z",
      "x_nadsec_last_seen": "2026-05-16T18:18:53.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9924"
      ],
      "x_nadsec_orgs": [
        "Taiwan Fixed Network, Telco and Network Service Provider."
      ]
    },
    {
      "created": "2026-05-16T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--8c03b35d-128f-48a3-affb-f000c4bf982a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:05:10.000Z",
      "valid_until": "2026-06-17T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T18:12:34.730Z",
      "x_nadsec_last_seen": "2026-05-16T18:12:34.730Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-16T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=265523; asn_org=Sierra Madre Internet SA de CV",
      "id": "indicator--5bb49337-f800-44bb-8415-adaeb1bbea16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.235.131.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:05:10.000Z",
      "valid_until": "2026-06-17T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T19:04:29.259Z",
      "x_nadsec_last_seen": "2026-05-16T19:12:02.991Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265523"
      ],
      "x_nadsec_orgs": [
        "Sierra Madre Internet SA de CV"
      ]
    },
    {
      "created": "2026-05-16T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--9a739eb7-f862-4cad-9abd-ca06832485d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.105.132.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:05:10.000Z",
      "valid_until": "2026-06-17T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T18:15:40.661Z",
      "x_nadsec_last_seen": "2026-05-16T18:22:04.719Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=53813; asn_org=ZSCALER, INC.",
      "id": "indicator--995e9481-2cbd-4aee-bf90-75513bc20311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.103.55.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T19:19:30.853Z",
      "x_nadsec_last_seen": "2026-05-16T19:29:01.718Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "53813"
      ],
      "x_nadsec_orgs": [
        "ZSCALER, INC."
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--691a87fa-6c8d-443d-9354-4bfc0b69398e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T19:50:24.484Z",
      "x_nadsec_last_seen": "2026-05-20T05:20:54.540Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--7fa03b88-b8ed-49a7-a39c-0dc7ca6d7a4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.113.255.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T19:21:57.838Z",
      "x_nadsec_last_seen": "2026-05-16T19:22:01.053Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--cd465a82-dbc5-4588-9eab-2fabe61243c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.96.139.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T19:13:02.680Z",
      "x_nadsec_last_seen": "2026-05-16T19:13:02.680Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--31be608e-fadd-425a-836e-e1a2950d50be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T19:44:40.911Z",
      "x_nadsec_last_seen": "2026-05-16T19:44:40.911Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=18747; asn_org=IFX Corporation",
      "id": "indicator--d86b4e83-d8de-4c13-8dfb-fdb5ed4372d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.62.63.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T19:09:03.850Z",
      "x_nadsec_last_seen": "2026-05-16T19:09:40.775Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "18747"
      ],
      "x_nadsec_orgs": [
        "IFX Corporation"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=18103; asn_org=Neuviz Net",
      "id": "indicator--32a613c4-e263-4390-a7d9-15871cf4a6ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.128.67.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-16T20:02:34.177Z",
      "x_nadsec_last_seen": "2026-05-29T18:02:40.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "18103"
      ],
      "x_nadsec_orgs": [
        "Neuviz Net"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--67064104-ff20-40d6-b9da-86c890cd468f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.192.224.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T19:10:55.983Z",
      "x_nadsec_last_seen": "2026-05-16T19:10:56.035Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VE; asn=263703; asn_org=VIGINET C.A; user(top)=**",
      "id": "indicator--d4628c89-3921-4c90-a998-a5018585f8ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.186.209.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T19:57:58.375Z",
      "x_nadsec_last_seen": "2026-05-16T19:57:58.375Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "263703"
      ],
      "x_nadsec_orgs": [
        "VIGINET C.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d0405b62-cd26-4aa4-836c-0e58d6675073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.120.116.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T19:45:38.368Z",
      "x_nadsec_last_seen": "2026-05-23T16:19:30.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-16T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--02a2b7e3-9f6a-4916-a100-56936b4f7dc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.249.144.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T20:05:10.000Z",
      "valid_until": "2026-06-17T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T19:50:52.146Z",
      "x_nadsec_last_seen": "2026-05-23T16:17:25.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-16T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=151355; asn_org=Software operation, Foreign trade",
      "id": "indicator--c3f121be-a9de-4b53-a70b-146cba2e270b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.209.212.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:05:10.000Z",
      "valid_until": "2026-06-17T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T20:09:24.764Z",
      "x_nadsec_last_seen": "2026-05-16T20:11:31.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "151355"
      ],
      "x_nadsec_orgs": [
        "Software operation, Foreign trade"
      ]
    },
    {
      "created": "2026-05-16T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--e810d45d-ec54-4e69-864f-66fd609b53d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.86.72.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:05:10.000Z",
      "valid_until": "2026-06-17T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T20:17:18.934Z",
      "x_nadsec_last_seen": "2026-05-16T20:17:19.457Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-16T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--cf9dbb9d-764c-4c9c-bb9c-975b40fd7c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.176.87.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:05:10.000Z",
      "valid_until": "2026-06-17T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T20:53:17.455Z",
      "x_nadsec_last_seen": "2026-05-16T20:55:24.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-16T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=MN; asn=45204; asn_org=GEMNET LLC",
      "id": "indicator--00eabd39-b3e5-4f2a-bb49-946fb5f53489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.149.126.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:05:10.000Z",
      "valid_until": "2026-06-17T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T20:14:48.792Z",
      "x_nadsec_last_seen": "2026-05-16T20:14:48.792Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "45204"
      ],
      "x_nadsec_orgs": [
        "GEMNET LLC"
      ]
    },
    {
      "created": "2026-05-16T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=207251; asn_org=CASPEL LLC; user(top)=**",
      "id": "indicator--61a40e57-20cd-46a5-b550-c45c66a13fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.132.42.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T21:05:10.000Z",
      "valid_until": "2026-06-17T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T21:02:51.313Z",
      "x_nadsec_last_seen": "2026-05-16T21:02:51.313Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "207251"
      ],
      "x_nadsec_orgs": [
        "CASPEL LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-16T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--dd8df2d5-77b2-44db-be8d-d754bd3c1cf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.201.38.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:05:14.000Z",
      "valid_until": "2026-06-17T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T21:25:20.795Z",
      "x_nadsec_last_seen": "2026-05-16T21:25:47.626Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-16T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=27831; asn_org=Colombia Movil",
      "id": "indicator--38742172-02ee-4d51-9f5d-7f25d3079bb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.180.175.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:05:14.000Z",
      "valid_until": "2026-06-17T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-16T21:21:09.730Z",
      "x_nadsec_last_seen": "2026-05-16T21:21:09.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27831"
      ],
      "x_nadsec_orgs": [
        "Colombia Movil"
      ]
    },
    {
      "created": "2026-05-16T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--ec1433e7-9fab-4d53-a0c5-e3e3479aaac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.248.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:05:14.000Z",
      "valid_until": "2026-06-17T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T21:43:51.488Z",
      "x_nadsec_last_seen": "2026-05-16T21:45:57.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-05-16T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d65ac846-103b-4849-aab1-1898e1a2dd29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.14.80.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:05:14.000Z",
      "valid_until": "2026-06-17T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T21:23:31.880Z",
      "x_nadsec_last_seen": "2026-05-16T21:23:32.466Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-16T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=CA; asn=11260; asn_org=EastLink; user(top)=a***n",
      "id": "indicator--d3440b89-2fc6-4d1a-b43f-2acac6bc6cdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.142.5.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:05:14.000Z",
      "valid_until": "2026-06-17T22:05:09.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-05-16T21:43:55.247Z",
      "x_nadsec_last_seen": "2026-05-16T21:48:50.489Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "11260"
      ],
      "x_nadsec_orgs": [
        "EastLink"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-16T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GD; asn=23520; asn_org=Columbus Networks USA, Inc.",
      "id": "indicator--33a68fa6-e9de-4e25-971b-48e547f32d57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '63.245.45.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T22:05:14.000Z",
      "valid_until": "2026-06-17T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T21:46:22.936Z",
      "x_nadsec_last_seen": "2026-05-16T21:48:29.244Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GD"
      ],
      "x_nadsec_asns": [
        "23520"
      ],
      "x_nadsec_orgs": [
        "Columbus Networks USA, Inc."
      ]
    },
    {
      "created": "2026-05-16T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--73f02eed-936c-4b33-9003-565e81209be0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.97.219.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:05:10.000Z",
      "valid_until": "2026-06-17T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T22:23:18.158Z",
      "x_nadsec_last_seen": "2026-05-16T22:23:18.158Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-16T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=63199; asn_org=CDS Global Cloud Co., Ltd",
      "id": "indicator--02885978-a19c-4db6-98a1-0f157b114e37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.153.56.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:05:10.000Z",
      "valid_until": "2026-06-17T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T22:35:09.800Z",
      "x_nadsec_last_seen": "2026-05-16T22:36:09.828Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63199"
      ],
      "x_nadsec_orgs": [
        "CDS Global Cloud Co., Ltd"
      ]
    },
    {
      "created": "2026-05-16T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:05:10.000Z",
      "valid_until": "2026-06-17T23:05:09.000Z",
      "x_nadsec_event_count": 218,
      "x_nadsec_first_seen": "2026-05-16T22:45:01.541Z",
      "x_nadsec_last_seen": "2026-05-21T14:32:00.258Z",
      "x_nadsec_ports": [
        "3306",
        "1723",
        "445",
        "81",
        "1433",
        "21",
        "135",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd",
        "smbd",
        "httpd",
        "mssqld",
        "ftpd",
        "epmapper",
        "mqttd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-16T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--ba2d8d3d-7045-4c35-8d1d-a1110afe1413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.184.92.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:05:10.000Z",
      "valid_until": "2026-06-17T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T22:23:33.007Z",
      "x_nadsec_last_seen": "2026-05-16T22:31:01.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-16T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--1a457d21-c7a7-4b5a-b0b2-8b3d2fa34ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-16T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T23:05:10.000Z",
      "valid_until": "2026-06-17T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T22:40:49.084Z",
      "x_nadsec_last_seen": "2026-05-16T22:40:49.084Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--063695f1-576e-47b7-924a-f5860917274d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.168.211.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T00:02:43.674Z",
      "x_nadsec_last_seen": "2026-05-17T00:04:50.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--77172c58-0b3b-4310-8b4b-27b813ea969b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.178.208.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-16T23:47:52.048Z",
      "x_nadsec_last_seen": "2026-05-16T23:49:59.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7ac7253e-6ced-4aa4-b514-f3817614193d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.46.106.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-16T23:52:42.812Z",
      "x_nadsec_last_seen": "2026-05-17T00:02:30.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--101fb7d8-7726-41b3-b694-45f6d7039b2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T23:51:24.767Z",
      "x_nadsec_last_seen": "2026-05-16T23:51:24.767Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a7042379-fad4-40e0-8b2d-14f9ca645e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T23:21:46.931Z",
      "x_nadsec_last_seen": "2026-05-16T23:21:46.931Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7e9ed786-ffd8-41fd-9e1d-0a415a99a4f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T23:16:11.606Z",
      "x_nadsec_last_seen": "2026-05-16T23:16:11.606Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e63b0269-c525-4bdc-acc6-b9ee1f695482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-16T23:15:45.216Z",
      "x_nadsec_last_seen": "2026-05-16T23:15:45.216Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-17T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d597cf65-3447-4da6-8186-9e565625a921",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:05:12.000Z",
      "valid_until": "2026-06-18T00:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-16T23:15:45.336Z",
      "x_nadsec_last_seen": "2026-05-27T18:42:31.290Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-17T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8eab0045-65d0-4e32-aa3b-59050f18d76a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.139.70.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:05:10.000Z",
      "valid_until": "2026-06-18T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T00:49:31.075Z",
      "x_nadsec_last_seen": "2026-05-17T00:49:31.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-17T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--75837af7-5bff-4e97-8141-198d8bf54273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.144.127.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:05:10.000Z",
      "valid_until": "2026-06-18T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T00:58:49.833Z",
      "x_nadsec_last_seen": "2026-05-31T23:44:35.204Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-17T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bb735259-c370-4064-8160-d91a35b839ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:05:10.000Z",
      "valid_until": "2026-06-18T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T00:26:22.898Z",
      "x_nadsec_last_seen": "2026-05-17T00:26:22.898Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--11b1a56a-bc98-4713-abda-0f0c97bb12d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.89.103.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:05:10.000Z",
      "valid_until": "2026-06-18T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T00:58:47.537Z",
      "x_nadsec_last_seen": "2026-05-17T00:58:47.537Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-17T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BA; asn=42560; asn_org=Telemach BH d.o.o. Sarajevo; user(top)=**",
      "id": "indicator--7829dfb7-c2d6-4741-830a-5882ac8ee255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.78.203.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:05:10.000Z",
      "valid_until": "2026-06-18T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T00:30:35.981Z",
      "x_nadsec_last_seen": "2026-05-17T00:30:35.981Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BA"
      ],
      "x_nadsec_asns": [
        "42560"
      ],
      "x_nadsec_orgs": [
        "Telemach BH d.o.o. Sarajevo"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--16751b38-c3d1-4cfb-b291-eab50e1caad7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.49.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:05:10.000Z",
      "valid_until": "2026-06-18T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T01:06:04.190Z",
      "x_nadsec_last_seen": "2026-05-17T01:13:00.385Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-17T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--11f08629-7428-4caa-95cf-5258a03d9ecb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:05:10.000Z",
      "valid_until": "2026-06-18T02:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T01:35:50.748Z",
      "x_nadsec_last_seen": "2026-05-17T01:35:51.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fff54572-ac0e-4b91-b956-f7dddeb53bdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.55.72.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:05:10.000Z",
      "valid_until": "2026-06-18T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T01:29:13.884Z",
      "x_nadsec_last_seen": "2026-05-17T01:29:13.884Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=AR; asn=266702; asn_org=MEGALINK S.R.L.",
      "id": "indicator--9e043ed7-ece8-4223-a7e0-56a839560257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.230.66.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:05:10.000Z",
      "valid_until": "2026-06-18T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T01:31:30.979Z",
      "x_nadsec_last_seen": "2026-05-17T01:31:30.979Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "266702"
      ],
      "x_nadsec_orgs": [
        "MEGALINK S.R.L."
      ]
    },
    {
      "created": "2026-05-17T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=43679; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--059dec12-b8d4-4cdf-9c8a-f32608c6f39b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:05:05.000Z",
      "valid_until": "2026-06-18T03:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T02:25:49.011Z",
      "x_nadsec_last_seen": "2026-05-17T02:25:49.014Z",
      "x_nadsec_ports": [
        "42",
        "43679"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--bf3325ca-7b42-49e2-8d16-e0ef87f5f4c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:05:05.000Z",
      "valid_until": "2026-06-18T03:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-17T02:05:28.309Z",
      "x_nadsec_last_seen": "2026-05-17T02:06:04.354Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-17T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--ed98c081-4298-4250-a884-6e8b38e2e30e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.139.172.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:05:05.000Z",
      "valid_until": "2026-06-18T03:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T02:52:55.094Z",
      "x_nadsec_last_seen": "2026-05-17T03:00:18.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-17T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--c618bb53-fd2b-45a0-8c81-63e0c33c31b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.221.164.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:05:05.000Z",
      "valid_until": "2026-06-18T03:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T02:59:56.122Z",
      "x_nadsec_last_seen": "2026-05-20T21:17:17.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-05-17T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KH; asn=38235; asn_org=ANGKOR DATA COMMUNICATION",
      "id": "indicator--0d1f328c-6d31-4eae-97fc-3c0190c46f17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.176.138.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:05:05.000Z",
      "valid_until": "2026-06-18T03:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T03:01:53.574Z",
      "x_nadsec_last_seen": "2026-05-17T03:03:58.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38235"
      ],
      "x_nadsec_orgs": [
        "ANGKOR DATA COMMUNICATION"
      ]
    },
    {
      "created": "2026-05-17T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=ES; asn=34977; asn_org=Procono S.A.",
      "id": "indicator--bc4d3ad2-7ffa-4b77-863c-5b88a44320f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.225.179.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:05:05.000Z",
      "valid_until": "2026-06-18T03:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T02:37:38.913Z",
      "x_nadsec_last_seen": "2026-05-17T02:37:38.913Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "34977"
      ],
      "x_nadsec_orgs": [
        "Procono S.A."
      ]
    },
    {
      "created": "2026-05-17T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--584f4730-63cb-4a6a-ade4-9be9fd2cea63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.91.65.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:05:05.000Z",
      "valid_until": "2026-06-18T03:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T03:00:32.297Z",
      "x_nadsec_last_seen": "2026-05-17T03:01:16.094Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b5fed883-c7e1-4b88-978c-ef494955bd37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.44.134.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T03:17:57.335Z",
      "x_nadsec_last_seen": "2026-05-17T03:22:30.590Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=23966; asn_org=LINKdotNET Telecom Limited",
      "id": "indicator--bde3a1b7-251c-487a-b023-6c4d3627c6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.223.174.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T04:02:20.869Z",
      "x_nadsec_last_seen": "2026-05-17T04:09:04.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23966"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET Telecom Limited"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b7c7911c-39fd-4903-981d-0e2c31507004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.18.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T03:28:54.480Z",
      "x_nadsec_last_seen": "2026-05-17T03:28:54.480Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9a85b5c3-fc9e-4c55-923d-98905d4e8ae3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.156.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T03:29:09.479Z",
      "x_nadsec_last_seen": "2026-05-17T03:29:43.113Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--ee9c2970-e7c4-45b7-a029-65971558d588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.228.177.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T03:05:22.366Z",
      "x_nadsec_last_seen": "2026-05-17T03:05:26.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--1dcd3ae5-a148-4896-868c-d0a9321f4c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-17T03:53:49.501Z",
      "x_nadsec_last_seen": "2026-05-31T18:26:34.781Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-17T03:22:16.071Z",
      "x_nadsec_last_seen": "2026-05-31T13:52:43.591Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9fd0b0c3-013d-441f-8aa8-4d689652e903",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.95.188.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T03:35:17.312Z",
      "x_nadsec_last_seen": "2026-05-17T03:36:39.387Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-17T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35566; asn_org=Kar-Tel LLC",
      "id": "indicator--318f6c56-7c57-4445-b287-423becdd160c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.247.12.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:05:10.000Z",
      "valid_until": "2026-06-18T04:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-17T03:06:33.785Z",
      "x_nadsec_last_seen": "2026-05-27T01:12:46.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35566"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-05-17T05:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=134768; asn_org=CHINANET SHAANXI province Cloud Base network",
      "id": "indicator--9bc34f70-07b5-48d4-8a74-fb0e190086b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.236.80.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:05:15.000Z",
      "valid_until": "2026-06-18T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T04:40:03.700Z",
      "x_nadsec_last_seen": "2026-05-17T04:40:03.786Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134768"
      ],
      "x_nadsec_orgs": [
        "CHINANET SHAANXI province Cloud Base network"
      ]
    },
    {
      "created": "2026-05-17T05:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2a77a765-07ca-442d-903c-bd358662095f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:05:15.000Z",
      "valid_until": "2026-06-18T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T04:13:59.463Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:16.347Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-17T05:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--beb9b60b-b7e7-4bee-9544-a8e750172457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:05:15.000Z",
      "valid_until": "2026-06-18T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T04:13:59.051Z",
      "x_nadsec_last_seen": "2026-05-17T04:13:59.051Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-17T05:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fc9fae7c-bfdd-4839-988a-34e1b546c5c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:05:15.000Z",
      "valid_until": "2026-06-18T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T04:32:55.881Z",
      "x_nadsec_last_seen": "2026-05-17T04:32:56.235Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T05:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--225883ea-fda8-45bf-8d29-f1a2cb6cce34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.80.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:05:15.000Z",
      "valid_until": "2026-06-18T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T04:40:23.696Z",
      "x_nadsec_last_seen": "2026-05-17T04:42:28.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-17T05:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IL; asn=6810; asn_org=Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "id": "indicator--91becaff-ab00-4031-964e-d38cfb9f9982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.235.207.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:05:15.000Z",
      "valid_until": "2026-06-18T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T04:25:58.618Z",
      "x_nadsec_last_seen": "2026-05-17T04:33:19.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "6810"
      ],
      "x_nadsec_orgs": [
        "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD."
      ]
    },
    {
      "created": "2026-05-17T05:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--67a8968b-4ed0-4a4f-9eb6-915da2b643a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T05:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.123.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:05:15.000Z",
      "valid_until": "2026-06-18T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T05:01:50.937Z",
      "x_nadsec_last_seen": "2026-05-17T05:01:50.937Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=136556; asn_org=MS BD ONLINE SYSTEMS",
      "id": "indicator--60e5fd34-8bc7-45e6-8d2f-b94974fe5014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.92.160.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T06:02:51.657Z",
      "x_nadsec_last_seen": "2026-05-17T06:04:56.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "136556"
      ],
      "x_nadsec_orgs": [
        "MS BD ONLINE SYSTEMS"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--43941c94-da44-4c70-812c-efb39ffc9cf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.0.126.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T05:20:39.392Z",
      "x_nadsec_last_seen": "2026-05-17T05:20:44.523Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--92c1ebb7-43b7-42de-89ca-c917542dfc9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.55.59.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T05:06:14.268Z",
      "x_nadsec_last_seen": "2026-05-17T05:06:14.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58495; asn_org=PT Parsaoran Global Datatrans",
      "id": "indicator--5bc3854d-0616-4950-91a1-039bacb5dbee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.10.107.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T05:22:02.252Z",
      "x_nadsec_last_seen": "2026-05-17T05:24:07.130Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58495"
      ],
      "x_nadsec_orgs": [
        "PT Parsaoran Global Datatrans"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CG; asn=37463; asn_org=MTN-CONGO",
      "id": "indicator--03b98991-e9bf-4f35-8db0-acbe8f310415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '169.255.122.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-17T06:04:37.302Z",
      "x_nadsec_last_seen": "2026-05-23T07:43:15.534Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CG"
      ],
      "x_nadsec_asns": [
        "37463"
      ],
      "x_nadsec_orgs": [
        "MTN-CONGO"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--5a76e15a-f83d-40f0-adb5-e111a28a70d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T05:39:44.847Z",
      "x_nadsec_last_seen": "2026-05-17T05:39:44.847Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--1441cfc8-b2b2-4263-b21a-d28c41d0a370",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.75.248.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T05:08:38.476Z",
      "x_nadsec_last_seen": "2026-05-17T05:08:38.476Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5466d5d2-2bbe-4e22-8edc-7491415401be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T05:25:36.119Z",
      "x_nadsec_last_seen": "2026-05-17T05:25:36.119Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7940b703-222b-4d55-ad81-96acbdb0e0c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T05:25:46.387Z",
      "x_nadsec_last_seen": "2026-05-17T05:25:46.387Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--875e45b0-22f0-408f-b091-8c637250f6c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.250.243.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-17T05:14:08.591Z",
      "x_nadsec_last_seen": "2026-05-23T22:18:15.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e01bf0a0-40ee-4b47-a034-c868c193d839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.219.170.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T05:42:14.609Z",
      "x_nadsec_last_seen": "2026-05-17T05:44:19.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T05:50:15.880Z",
      "x_nadsec_last_seen": "2026-05-17T05:50:47.797Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=25249; asn_org=Magticom Ltd.",
      "id": "indicator--76a55ed7-daf1-403e-8ca6-85d673afcea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.95.162.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T05:06:09.659Z",
      "x_nadsec_last_seen": "2026-05-17T05:08:21.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "25249"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--528004a4-5a9a-4c05-9ecc-4aac8524688a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T05:47:44.685Z",
      "x_nadsec_last_seen": "2026-05-17T05:47:44.685Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-17T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--347f7b08-e064-472a-98a3-3e9d8f52184b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:05:11.000Z",
      "valid_until": "2026-06-18T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T05:47:44.272Z",
      "x_nadsec_last_seen": "2026-05-17T05:47:44.272Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-17T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--67af446b-7d40-4330-975b-c57fbc91cbb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.241.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:05:10.000Z",
      "valid_until": "2026-06-18T07:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T06:27:16.726Z",
      "x_nadsec_last_seen": "2026-05-17T06:27:16.726Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-17T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0b7284de-8e59-4ad8-b884-8d0d7dbd3984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:05:10.000Z",
      "valid_until": "2026-06-18T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T06:06:05.025Z",
      "x_nadsec_last_seen": "2026-05-17T06:06:15.201Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--4ed2d688-829b-4b9a-a48f-c87f8a37288f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.182.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:05:10.000Z",
      "valid_until": "2026-06-18T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T06:07:41.120Z",
      "x_nadsec_last_seen": "2026-05-17T06:07:41.274Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-17T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:05:10.000Z",
      "valid_until": "2026-06-18T07:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T07:00:08.919Z",
      "x_nadsec_last_seen": "2026-05-24T18:03:54.659Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-17T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8f139568-043f-467a-9db4-5393a0d89ac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '90.151.249.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:05:10.000Z",
      "valid_until": "2026-06-18T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T06:33:27.437Z",
      "x_nadsec_last_seen": "2026-05-17T06:41:17.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--28663b88-a35e-4d3f-893c-74bf13fd7db6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.104.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-05-17T07:49:34.397Z",
      "x_nadsec_last_seen": "2026-05-17T12:46:05.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--bb1a7c72-6f5e-486b-ab29-5796437943f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.239.228.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-17T07:44:10.801Z",
      "x_nadsec_last_seen": "2026-05-18T08:46:16.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--36684f27-5014-475f-9a60-c2714dd9a293",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.183.37.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T07:39:55.734Z",
      "x_nadsec_last_seen": "2026-05-17T07:42:01.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T07:59:39.265Z",
      "x_nadsec_last_seen": "2026-05-17T07:59:39.265Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--38453f77-9097-4aad-a13f-77a21c90d2ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-17T07:54:56.595Z",
      "x_nadsec_last_seen": "2026-05-28T08:27:02.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PY; asn=27895; asn_org=Nucleo S.A.",
      "id": "indicator--a1591137-cfce-431a-b46b-081dc692ebed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.103.1.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-17T07:57:36.550Z",
      "x_nadsec_last_seen": "2026-05-19T12:08:42.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "27895"
      ],
      "x_nadsec_orgs": [
        "Nucleo S.A."
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--abd5bafb-907e-4ba1-a735-87382409d859",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.85.132.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-17T07:17:36.116Z",
      "x_nadsec_last_seen": "2026-05-17T20:30:29.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--261da30c-84e0-4f21-ab04-7d2871921778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T07:26:53.638Z",
      "x_nadsec_last_seen": "2026-05-17T07:30:09.877Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=38200; asn_org=BTS Communications BD ltd",
      "id": "indicator--924bdbae-1d7d-494a-aa17-8344a23a21a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.247.165.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-17T07:45:40.916Z",
      "x_nadsec_last_seen": "2026-05-23T10:27:58.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38200"
      ],
      "x_nadsec_orgs": [
        "BTS Communications BD ltd"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--935e0c9d-0310-4b40-ae25-5803cc51eec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.144.115.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T07:35:41.497Z",
      "x_nadsec_last_seen": "2026-05-17T07:35:41.497Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--9fd8f06f-67cc-4716-b52f-336ebdf02e4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T07:36:18.919Z",
      "x_nadsec_last_seen": "2026-05-17T07:36:19.415Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-17T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e85c0555-33ad-4150-9ec9-e907381d5f8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.207.162.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T08:05:10.000Z",
      "valid_until": "2026-06-18T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T07:20:13.439Z",
      "x_nadsec_last_seen": "2026-05-17T07:20:13.555Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132957; asn_org=Pintwire Infomatics Private Limited",
      "id": "indicator--a9e5e3b0-c34d-41e7-b371-04e4ed392364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '163.53.72.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T08:23:56.530Z",
      "x_nadsec_last_seen": "2026-05-17T08:26:01.805Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132957"
      ],
      "x_nadsec_orgs": [
        "Pintwire Infomatics Private Limited"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=LU; asn=214472; asn_org=Offshore LC",
      "id": "indicator--ec6c7bf4-5bd8-43e6-a54c-779c3f253e7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T08:12:08.245Z",
      "x_nadsec_last_seen": "2026-05-17T08:12:08.245Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "214472"
      ],
      "x_nadsec_orgs": [
        "Offshore LC"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--48b202cd-b086-4b5c-b007-6fdd47f8a04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.33.28.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T08:24:44.819Z",
      "x_nadsec_last_seen": "2026-05-17T08:26:51.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=133775; asn_org=Xiamen; user(top)=**",
      "id": "indicator--ac5e5c14-2203-4846-bff0-a995f20a6ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.188.45.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T08:34:50.853Z",
      "x_nadsec_last_seen": "2026-05-17T08:34:50.853Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "133775"
      ],
      "x_nadsec_orgs": [
        "Xiamen"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--63305f82-6c9a-4830-8809-6b93b5a00040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.32.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T09:04:50.812Z",
      "x_nadsec_last_seen": "2026-05-17T09:05:01.007Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--12b35dbf-f483-41b2-ab31-905e8d2c9301",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.106.154.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T08:14:05.074Z",
      "x_nadsec_last_seen": "2026-05-17T08:16:12.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37105; asn_org=RAIN-GROUP-HOLDINGS",
      "id": "indicator--63cace11-3dda-4779-8064-54c7a9b5e4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.56.195.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T08:48:48.573Z",
      "x_nadsec_last_seen": "2026-05-17T08:50:56.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37105"
      ],
      "x_nadsec_orgs": [
        "RAIN-GROUP-HOLDINGS"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--df6e6259-97aa-4bad-90d6-d86eb52678a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.99.136.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-17T08:43:18.459Z",
      "x_nadsec_last_seen": "2026-05-27T08:17:55.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--998b0abe-b8c1-469b-9219-31660577fd51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.149.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T08:55:29.630Z",
      "x_nadsec_last_seen": "2026-05-17T08:55:53.505Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=12479; asn_org=Orange Espagne SA",
      "id": "indicator--41c02dca-df06-4ab4-ac6e-158ef48c106e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.50.194.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T08:41:37.785Z",
      "x_nadsec_last_seen": "2026-05-23T12:30:59.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12479"
      ],
      "x_nadsec_orgs": [
        "Orange Espagne SA"
      ]
    },
    {
      "created": "2026-05-17T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--9b269b4d-505f-4b9c-ba77-87210944a83a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.97.188.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:05:10.000Z",
      "valid_until": "2026-06-18T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T08:50:47.312Z",
      "x_nadsec_last_seen": "2026-05-17T08:57:53.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-17T10:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--27c46f66-0daf-4bb4-97a4-30c712f135df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.74.203.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:05:19.000Z",
      "valid_until": "2026-06-18T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T09:38:03.167Z",
      "x_nadsec_last_seen": "2026-05-17T09:40:08.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-17T10:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f1d1428e-be5b-4085-bb3a-d6ff03d541fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.163.201.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:05:19.000Z",
      "valid_until": "2026-06-18T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T09:23:08.644Z",
      "x_nadsec_last_seen": "2026-05-17T09:25:13.804Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-17T10:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--7446f4d0-3b9b-47e1-ac90-06580f66b94e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.229.223.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:05:19.000Z",
      "valid_until": "2026-06-18T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T09:15:56.310Z",
      "x_nadsec_last_seen": "2026-05-17T09:18:01.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-17T10:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=26479; asn_org=Point Broadband Fiber Holding, LLC",
      "id": "indicator--5596db70-4170-44a4-b5a2-cb700a8fd58e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.88.26.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:05:19.000Z",
      "valid_until": "2026-06-18T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T09:50:46.978Z",
      "x_nadsec_last_seen": "2026-05-17T09:57:49.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "26479"
      ],
      "x_nadsec_orgs": [
        "Point Broadband Fiber Holding, LLC"
      ]
    },
    {
      "created": "2026-05-17T10:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--91ae114b-8ca1-4a7c-85b3-3bb9e1e0efc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.33.56.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:05:19.000Z",
      "valid_until": "2026-06-18T10:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-17T09:45:05.492Z",
      "x_nadsec_last_seen": "2026-05-24T18:40:28.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-17T10:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=12430; asn_org=Vodafone Spain",
      "id": "indicator--4df41694-8d21-4e0b-ad42-124ad3afbe51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.62.4.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:05:19.000Z",
      "valid_until": "2026-06-18T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T09:08:10.550Z",
      "x_nadsec_last_seen": "2026-05-17T09:10:17.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12430"
      ],
      "x_nadsec_orgs": [
        "Vodafone Spain"
      ]
    },
    {
      "created": "2026-05-17T10:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--ea0aa770-7ceb-4b6e-a8b3-7aa327b5d535",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T10:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.219.125.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:05:19.000Z",
      "valid_until": "2026-06-18T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T09:58:16.510Z",
      "x_nadsec_last_seen": "2026-05-17T09:58:40.059Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-17T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--0782cce2-d3c0-44bd-938d-61194db44dec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.50.173.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:05:10.000Z",
      "valid_until": "2026-06-18T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T10:54:35.369Z",
      "x_nadsec_last_seen": "2026-05-17T10:56:40.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-17T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--ff6fa2a7-4e70-4532-89e1-4b079a4bf312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:05:10.000Z",
      "valid_until": "2026-06-18T11:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-17T10:27:33.683Z",
      "x_nadsec_last_seen": "2026-05-17T10:28:55.152Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-17T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--2dcf690f-c07c-4049-8272-14c1abc3faac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:05:10.000Z",
      "valid_until": "2026-06-18T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T10:28:39.605Z",
      "x_nadsec_last_seen": "2026-05-17T10:28:39.605Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-17T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--53738dc8-392e-4791-8a33-b4be7ca66287",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:05:10.000Z",
      "valid_until": "2026-06-18T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T10:28:16.063Z",
      "x_nadsec_last_seen": "2026-05-17T10:28:24.329Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-17T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--b4264b74-6c89-4f68-a3cc-25a8cc05e8c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T11:05:10.000Z",
      "valid_until": "2026-06-18T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T10:27:45.266Z",
      "x_nadsec_last_seen": "2026-05-17T10:28:44.614Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-17T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=139490; asn_org=Aspt Networks Pvt Ltd",
      "id": "indicator--35cb66a4-6c0c-4fa5-b0a6-ce6a9da24934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.203.175.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:05:09.000Z",
      "valid_until": "2026-06-18T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T11:20:45.515Z",
      "x_nadsec_last_seen": "2026-05-17T11:22:50.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139490"
      ],
      "x_nadsec_orgs": [
        "Aspt Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-17T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=139490; asn_org=Aspt Networks Pvt Ltd",
      "id": "indicator--833488fd-1719-4226-8e0b-b798d56ed3d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.203.175.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:05:09.000Z",
      "valid_until": "2026-06-18T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T11:20:45.338Z",
      "x_nadsec_last_seen": "2026-05-17T11:20:45.338Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139490"
      ],
      "x_nadsec_orgs": [
        "Aspt Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-17T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--6b8a0cf0-7dc3-4d29-bae7-8de7e2f2359a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.75.125.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:05:09.000Z",
      "valid_until": "2026-06-18T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T11:32:35.359Z",
      "x_nadsec_last_seen": "2026-05-25T00:09:24.290Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dbfad94a-77f8-42c9-a75d-dd4f69c9e456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.203.202.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:05:09.000Z",
      "valid_until": "2026-06-18T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T11:22:15.539Z",
      "x_nadsec_last_seen": "2026-05-17T11:22:25.716Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T12:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T12:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T12:05:09.000Z",
      "valid_until": "2026-06-18T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T11:51:47.647Z",
      "x_nadsec_last_seen": "2026-05-17T11:51:47.647Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-05-17T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--95e97da2-809e-404b-b696-1ff96d10e187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.110.48.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:05:09.000Z",
      "valid_until": "2026-06-18T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T12:09:21.357Z",
      "x_nadsec_last_seen": "2026-05-17T12:11:27.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-05-17T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7a58701d-c68e-4e7d-82b0-ea2b3c437405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:05:09.000Z",
      "valid_until": "2026-06-18T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T12:28:15.045Z",
      "x_nadsec_last_seen": "2026-05-17T12:28:15.045Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=TW; asn=208137; asn_org=Feo Prest SRL; user(top)=r**t",
      "id": "indicator--5d82164b-9dc4-4a75-aafc-503c4e395f38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:05:09.000Z",
      "valid_until": "2026-06-18T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T12:13:06.761Z",
      "x_nadsec_last_seen": "2026-05-17T12:13:06.761Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b317e924-3658-4ebf-9ef5-2b148be6877d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.126.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:05:09.000Z",
      "valid_until": "2026-06-18T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T12:52:01.296Z",
      "x_nadsec_last_seen": "2026-05-31T14:02:21.017Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-17T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--25482ed0-621e-4a0b-84c2-6c1f725a38a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.111.224.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:05:09.000Z",
      "valid_until": "2026-06-18T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T12:25:15.705Z",
      "x_nadsec_last_seen": "2026-05-17T12:32:35.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-17T13:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--39c580b9-69aa-48ff-91df-59a59ded9c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T13:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T13:05:09.000Z",
      "valid_until": "2026-06-18T13:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T12:39:49.515Z",
      "x_nadsec_last_seen": "2026-05-20T17:32:36.129Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-17T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=134502; asn_org=Victorians Online",
      "id": "indicator--6576bf41-20a4-43ae-ab2a-5839f475604e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.161.71.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:05:10.000Z",
      "valid_until": "2026-06-18T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T13:23:28.891Z",
      "x_nadsec_last_seen": "2026-05-17T13:23:33.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "134502"
      ],
      "x_nadsec_orgs": [
        "Victorians Online"
      ]
    },
    {
      "created": "2026-05-17T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--e8f05d98-4a19-4794-8dda-68a840205e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.4.33.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:05:10.000Z",
      "valid_until": "2026-06-18T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T13:18:07.258Z",
      "x_nadsec_last_seen": "2026-05-17T13:20:12.055Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-17T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=61753; asn_org=MARIA NEUSA PEREIRA DE SOUSA E CIA LTDA EPP",
      "id": "indicator--a603e17b-853f-4b87-bcda-2de8aba8b136",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '131.100.19.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:05:10.000Z",
      "valid_until": "2026-06-18T14:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-17T13:15:08.857Z",
      "x_nadsec_last_seen": "2026-05-24T03:45:11.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61753"
      ],
      "x_nadsec_orgs": [
        "MARIA NEUSA PEREIRA DE SOUSA E CIA LTDA EPP"
      ]
    },
    {
      "created": "2026-05-17T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--6e8c6f52-80f7-4dca-b513-1b366ebbb693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.38.176.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T14:05:10.000Z",
      "valid_until": "2026-06-18T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T13:22:01.016Z",
      "x_nadsec_last_seen": "2026-05-17T13:24:07.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-17T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=ID; asn=138096; asn_org=PT INFORMASI NUSANTARA TEKNOLOGI",
      "id": "indicator--aecb6bbc-a025-4126-abc1-bd23ec5d413c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.124.196.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:05:10.000Z",
      "valid_until": "2026-06-18T15:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-17T14:19:56.547Z",
      "x_nadsec_last_seen": "2026-05-17T14:34:12.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138096"
      ],
      "x_nadsec_orgs": [
        "PT INFORMASI NUSANTARA TEKNOLOGI"
      ]
    },
    {
      "created": "2026-05-17T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7049; asn_org=Silica Networks Argentina S.A.",
      "id": "indicator--3c4b993c-52a5-42c6-bf90-6615408dd724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.61.14.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:05:10.000Z",
      "valid_until": "2026-06-18T15:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-17T14:23:12.936Z",
      "x_nadsec_last_seen": "2026-05-19T05:41:49.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7049"
      ],
      "x_nadsec_orgs": [
        "Silica Networks Argentina S.A."
      ]
    },
    {
      "created": "2026-05-17T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--6ad90062-bb88-4500-b96f-49049bff1c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.150.169.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:05:10.000Z",
      "valid_until": "2026-06-18T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T14:38:54.563Z",
      "x_nadsec_last_seen": "2026-05-17T14:41:01.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-17T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:05:10.000Z",
      "valid_until": "2026-06-18T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T14:13:03.991Z",
      "x_nadsec_last_seen": "2026-05-17T14:13:04.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-17T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--e780b59e-5f36-4d24-83ae-4c4eb5394a19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.100.115.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T15:05:10.000Z",
      "valid_until": "2026-06-18T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T14:41:41.730Z",
      "x_nadsec_last_seen": "2026-05-17T14:41:42.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-17T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--bfa2054f-7f37-4bb9-8875-9055915b4bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.101.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:05:10.000Z",
      "valid_until": "2026-06-18T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T15:44:40.272Z",
      "x_nadsec_last_seen": "2026-05-17T15:46:50.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-17T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--ec6badc9-7bce-4343-9f3a-11fb8c98f044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.37.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:05:10.000Z",
      "valid_until": "2026-06-18T16:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T15:36:49.749Z",
      "x_nadsec_last_seen": "2026-05-17T15:38:55.103Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-17T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45769; asn_org=D-Vois Broadband Pvt Ltd",
      "id": "indicator--24722609-a55f-450d-896a-433d46aaac48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.122.20.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:05:10.000Z",
      "valid_until": "2026-06-18T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T15:34:01.398Z",
      "x_nadsec_last_seen": "2026-05-17T15:36:07.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45769"
      ],
      "x_nadsec_orgs": [
        "D-Vois Broadband Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-17T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--36820bcc-30f6-4b74-b090-a282e5991ab6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.76.116.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:05:10.000Z",
      "valid_until": "2026-06-18T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T15:40:11.985Z",
      "x_nadsec_last_seen": "2026-05-17T15:40:22.177Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=136787; asn_org=PacketHub S.A.; user(top)=a*******s; pass(top)=m*****a@example.com",
      "id": "indicator--a75398c8-7633-4790-9bb0-6092a28549a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.136.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:05:10.000Z",
      "valid_until": "2026-06-18T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T15:44:16.998Z",
      "x_nadsec_last_seen": "2026-05-17T15:44:16.998Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "136787"
      ],
      "x_nadsec_orgs": [
        "PacketHub S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "m*****************m"
      ]
    },
    {
      "created": "2026-05-17T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LT; asn=25406; asn_org=Splius, Uab",
      "id": "indicator--b9d320f4-05e4-45c9-8ead-de19d22078a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.249.171.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:05:10.000Z",
      "valid_until": "2026-06-18T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T15:46:30.001Z",
      "x_nadsec_last_seen": "2026-05-17T15:48:36.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "25406"
      ],
      "x_nadsec_orgs": [
        "Splius, Uab"
      ]
    },
    {
      "created": "2026-05-17T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--2ca5b9e0-40f4-49ab-9de2-fd75a6ab6e1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.166.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:05:10.000Z",
      "valid_until": "2026-06-18T17:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-17T16:19:27.431Z",
      "x_nadsec_last_seen": "2026-05-18T03:49:17.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-17T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--4dfa467e-9418-4c1f-ac63-da95aa57ebfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.225.231.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:05:10.000Z",
      "valid_until": "2026-06-18T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T17:02:37.050Z",
      "x_nadsec_last_seen": "2026-05-17T17:04:43.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-05-17T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--782330f8-51ee-4781-ae77-9bfbfe4b4a26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.141.83.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:05:10.000Z",
      "valid_until": "2026-06-18T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T16:56:52.804Z",
      "x_nadsec_last_seen": "2026-05-17T17:05:33.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-17T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC",
      "id": "indicator--d68108dc-adeb-4f2d-adda-bc453d0e0610",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.190.241.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T17:05:10.000Z",
      "valid_until": "2026-06-18T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-17T16:52:40.308Z",
      "x_nadsec_last_seen": "2026-05-17T16:59:57.871Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200590"
      ],
      "x_nadsec_orgs": [
        "NLS Kazakhstan LLC"
      ]
    },
    {
      "created": "2026-05-17T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e8767e57-4144-43c2-85ef-b4829e839ae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.251.203.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:05:04.000Z",
      "valid_until": "2026-06-18T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T17:29:24.436Z",
      "x_nadsec_last_seen": "2026-05-17T17:31:29.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-17T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d90fd648-515b-4e16-9061-85bc79d80ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.202.224.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:05:04.000Z",
      "valid_until": "2026-06-18T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T17:27:45.048Z",
      "x_nadsec_last_seen": "2026-05-17T17:29:52.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-17T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9965f437-9ce0-4393-bbcb-9cdefc28871e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.252.156.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:05:04.000Z",
      "valid_until": "2026-06-18T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T18:00:00.580Z",
      "x_nadsec_last_seen": "2026-05-17T18:02:05.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-17T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8cf0fd26-299a-4c32-9962-3731317b16c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.252.23.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:05:04.000Z",
      "valid_until": "2026-06-18T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T17:25:20.370Z",
      "x_nadsec_last_seen": "2026-05-17T17:27:25.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-17T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28812; asn_org=PJSC Bashinformsvyaz",
      "id": "indicator--a30ff4a5-8b6c-4c06-936f-4a15bd21c048",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.8.136.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:05:04.000Z",
      "valid_until": "2026-06-18T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T17:13:01.257Z",
      "x_nadsec_last_seen": "2026-05-17T17:15:08.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28812"
      ],
      "x_nadsec_orgs": [
        "PJSC Bashinformsvyaz"
      ]
    },
    {
      "created": "2026-05-17T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T18:05:04.000Z",
      "valid_until": "2026-06-18T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T17:32:41.984Z",
      "x_nadsec_last_seen": "2026-05-17T17:32:41.984Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-17T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a0bda11d-e696-448c-91a8-8850613727ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.36.114.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:05:04.000Z",
      "valid_until": "2026-06-18T19:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T18:28:50.075Z",
      "x_nadsec_last_seen": "2026-05-17T18:29:11.114Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--531d3558-bef3-4f5f-94e7-2eb6d470b712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.209.20.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:05:04.000Z",
      "valid_until": "2026-06-18T19:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T18:48:22.695Z",
      "x_nadsec_last_seen": "2026-05-17T18:50:29.298Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-17T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--53a952de-ac0b-4db1-b3ec-2ba32ad8d990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:05:04.000Z",
      "valid_until": "2026-06-18T19:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T18:33:52.990Z",
      "x_nadsec_last_seen": "2026-05-21T02:41:45.022Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--abf0b2de-4276-4acb-8fcd-76b0d3db58de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T19:05:04.000Z",
      "valid_until": "2026-06-18T19:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T18:14:36.084Z",
      "x_nadsec_last_seen": "2026-05-17T18:14:36.084Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-17T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--02998fda-b105-4ec9-acb0-ac3481d4d899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.120.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:05:10.000Z",
      "valid_until": "2026-06-18T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T19:39:23.637Z",
      "x_nadsec_last_seen": "2026-05-17T19:39:42.463Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-17T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--13fcf746-7b54-49b3-abda-71c6218439f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.54.125.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:05:10.000Z",
      "valid_until": "2026-06-18T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T20:04:19.381Z",
      "x_nadsec_last_seen": "2026-05-17T20:04:26.879Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-17T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.; user(top)=**",
      "id": "indicator--2ffa8a87-ae98-40bc-9db8-0ae66804db01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.132.11.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:05:10.000Z",
      "valid_until": "2026-06-18T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T19:58:23.879Z",
      "x_nadsec_last_seen": "2026-05-17T19:58:23.879Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d7bedb92-5545-45b7-a66d-5058d2bc52b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.78.243.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T20:05:10.000Z",
      "valid_until": "2026-06-18T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T19:48:11.246Z",
      "x_nadsec_last_seen": "2026-05-29T10:32:28.055Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-17T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--297c424d-287a-4eb7-b662-c5fb3679d8f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.134.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:05:06.000Z",
      "valid_until": "2026-06-18T21:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T20:18:05.079Z",
      "x_nadsec_last_seen": "2026-05-17T20:18:08.337Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-17T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d6934ee7-848d-44e1-a3b2-3ad289e6e1a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.226.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:05:06.000Z",
      "valid_until": "2026-06-18T21:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T21:01:57.981Z",
      "x_nadsec_last_seen": "2026-05-17T21:01:57.981Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-17T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--1e728455-c2c8-4d5d-a74a-1cca75f18f00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.250.65.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:05:06.000Z",
      "valid_until": "2026-06-18T21:05:03.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-17T20:19:45.894Z",
      "x_nadsec_last_seen": "2026-05-27T17:55:48.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-05-17T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--f828d00a-3a88-402b-a883-7f7a30ae60c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.3.54.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:05:06.000Z",
      "valid_until": "2026-06-18T21:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T20:59:04.048Z",
      "x_nadsec_last_seen": "2026-05-17T20:59:04.048Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=135918; asn_org=VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "id": "indicator--d8e66267-1bec-4f6b-a6af-459e392c43c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.10.198.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T21:39:39.378Z",
      "x_nadsec_last_seen": "2026-05-17T21:39:39.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135918"
      ],
      "x_nadsec_orgs": [
        "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY"
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--78ad70f6-4baf-49fe-9b32-bfa122312c32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.6.137.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T21:48:47.187Z",
      "x_nadsec_last_seen": "2026-05-17T21:50:53.967Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--1932d63a-25d1-4dcc-9e45-9d514cd0be4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.107.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T21:55:02.519Z",
      "x_nadsec_last_seen": "2026-05-17T22:50:20.323Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=6327; asn_org=Shaw Communications; user(top)=**",
      "id": "indicator--8694df63-367c-45fb-8e48-73a3ff9c9d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.70.159.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T21:52:21.190Z",
      "x_nadsec_last_seen": "2026-05-17T21:52:21.190Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "6327"
      ],
      "x_nadsec_orgs": [
        "Shaw Communications"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GB; asn=206067; asn_org=Three",
      "id": "indicator--1218bfde-dc0d-4183-9f18-822129011d4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.30.63.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T22:00:31.821Z",
      "x_nadsec_last_seen": "2026-05-17T22:00:32.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "206067"
      ],
      "x_nadsec_orgs": [
        "Three"
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GB; asn=206067; asn_org=Three",
      "id": "indicator--aea92fcb-e4a3-484a-8524-7bfcecf3ce75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.30.63.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T22:02:36.801Z",
      "x_nadsec_last_seen": "2026-05-17T22:02:38.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "206067"
      ],
      "x_nadsec_orgs": [
        "Three"
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--45291395-c9a8-441c-ba78-0d48c14218b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.145.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T21:06:07.458Z",
      "x_nadsec_last_seen": "2026-05-17T21:06:07.458Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f66a0850-1898-4714-b67b-d5f115fc3670",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.249.246.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-17T21:41:22.765Z",
      "x_nadsec_last_seen": "2026-05-17T21:41:55.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mirrord; ports=42; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d5b4fb65-dd79-4fde-98fd-88a465196940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-17T21:15:32.116Z",
      "x_nadsec_last_seen": "2026-05-17T21:15:43.002Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "41451"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-17T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--fcb667a6-c5c5-4d42-b922-be26abaa4df6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-17T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T22:05:10.000Z",
      "valid_until": "2026-06-18T22:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T21:20:56.949Z",
      "x_nadsec_last_seen": "2026-05-17T21:20:56.949Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--d1b2a3e2-58f5-47ac-8037-94483806221c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.58.239.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T23:31:02.214Z",
      "x_nadsec_last_seen": "2026-05-17T23:33:07.660Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.183.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-17T23:51:45.901Z",
      "x_nadsec_last_seen": "2026-05-17T23:56:07.739Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PY; asn=27895; asn_org=Nucleo S.A.",
      "id": "indicator--3959aff1-4012-4ae9-8b49-4f81fae2b3bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.1.153.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-17T23:06:25.982Z",
      "x_nadsec_last_seen": "2026-05-20T15:35:33.007Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "27895"
      ],
      "x_nadsec_orgs": [
        "Nucleo S.A."
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=24323; asn_org=aamra networks limited",
      "id": "indicator--e76679e0-08ca-413f-9027-ffaf266aa77d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.160.100.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T23:09:38.632Z",
      "x_nadsec_last_seen": "2026-05-17T23:11:43.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24323"
      ],
      "x_nadsec_orgs": [
        "aamra networks limited"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=60757; asn_org=Optinet LLP",
      "id": "indicator--2a709429-711d-41c3-aeb4-88d85b2336cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.217.188.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T00:03:11.309Z",
      "x_nadsec_last_seen": "2026-05-18T00:03:14.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "60757"
      ],
      "x_nadsec_orgs": [
        "Optinet LLP"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--d8b3499f-ea95-451f-b047-f633c0fb3117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.103.31.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T23:17:36.903Z",
      "x_nadsec_last_seen": "2026-05-17T23:19:42.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2c132482-4e6a-424f-ac4b-c8e421153d7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.40.216.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-17T23:09:35.238Z",
      "x_nadsec_last_seen": "2026-05-17T23:09:35.238Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ed8a6e8c-a8c5-4998-a798-0fc663004d11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T23:28:12.253Z",
      "x_nadsec_last_seen": "2026-05-17T23:28:22.576Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d213b855-f446-437f-bd4c-6c30c755fe89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.154.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-17T23:29:52.925Z",
      "x_nadsec_last_seen": "2026-05-17T23:29:53.563Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b0069be6-ed91-432c-80b0-18b9452d9b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.191.129.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T00:04:10.321Z",
      "x_nadsec_last_seen": "2026-05-18T00:06:16.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-18T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4dd90f92-454d-4124-8f01-88c8fe0e76b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.9.83.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:05:10.000Z",
      "valid_until": "2026-06-19T00:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-13T09:09:15.321Z",
      "x_nadsec_last_seen": "2026-05-17T23:46:05.693Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c95e648e-6bfb-4f96-b570-e7e2ff3371de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.93.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T01:02:48.498Z",
      "x_nadsec_last_seen": "2026-05-18T01:02:53.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4c442eaa-84c9-4c7f-ada8-39ba4061164d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.14.113.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T00:08:48.914Z",
      "x_nadsec_last_seen": "2026-05-18T00:08:48.914Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6d1b830d-89fd-4ecf-815b-3bed94570f98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.245.85.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T00:08:47.654Z",
      "x_nadsec_last_seen": "2026-05-18T00:08:47.654Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--cf55d2f8-b789-4b3e-adf4-08219a438a1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.227.31.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T00:08:28.134Z",
      "x_nadsec_last_seen": "2026-05-18T00:08:28.134Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--eab585f0-fe7a-4cd1-8519-2d99cff97eda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.123.76.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T00:08:34.860Z",
      "x_nadsec_last_seen": "2026-05-18T00:08:34.860Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--76397521-0c13-429c-9b39-2e2360d6d6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.189.110.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T00:19:59.244Z",
      "x_nadsec_last_seen": "2026-05-18T00:22:05.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--3ebd6617-55dc-4485-b803-8f7619d625a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.92.114.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T00:08:39.151Z",
      "x_nadsec_last_seen": "2026-05-18T00:08:39.151Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=42610; asn_org=Rostelecom",
      "id": "indicator--d9051e35-797f-4ba7-afd4-152479a31216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.255.123.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T00:49:56.057Z",
      "x_nadsec_last_seen": "2026-05-18T00:57:02.555Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42610"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9afe541c-6721-4634-b526-7b2b90deba15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.219.72.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T01:04:15.503Z",
      "x_nadsec_last_seen": "2026-05-18T01:04:15.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ae9d09f0-a979-4334-8564-d9a46cdd18f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T01:00:15.238Z",
      "x_nadsec_last_seen": "2026-05-18T01:00:15.238Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=137266; asn_org=CHINATELECOM Hubei province Wuhan 5G network",
      "id": "indicator--67347f69-17d6-458a-afd0-43b0cfe441c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.17.193.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T00:08:40.338Z",
      "x_nadsec_last_seen": "2026-05-18T00:08:40.338Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "137266"
      ],
      "x_nadsec_orgs": [
        "CHINATELECOM Hubei province Wuhan 5G network"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--b742822d-1ff1-4966-992f-f18fcd51938d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.87.26.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T00:56:48.593Z",
      "x_nadsec_last_seen": "2026-05-18T00:56:48.593Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--211ddca1-2e1d-4e0c-9764-b6231e5fe5f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.32.217.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T00:07:10.255Z",
      "x_nadsec_last_seen": "2026-05-18T00:07:10.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-18T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:05:11.000Z",
      "valid_until": "2026-06-19T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T00:39:41.391Z",
      "x_nadsec_last_seen": "2026-05-31T12:16:24.871Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=135407; asn_org=Trans World Enterprise Services Private Limited",
      "id": "indicator--31f34209-7a14-405e-9f80-3c36202b752c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.20.29.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T01:55:53.070Z",
      "x_nadsec_last_seen": "2026-05-18T01:55:58.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "135407"
      ],
      "x_nadsec_orgs": [
        "Trans World Enterprise Services Private Limited"
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c23e0b80-2271-43e4-a9f4-26d5dcf6113e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.25.240.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T01:45:38.047Z",
      "x_nadsec_last_seen": "2026-05-18T01:52:15.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--b7066f5c-07a6-41bd-938a-38e62878adb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.21.123.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T01:49:07.620Z",
      "x_nadsec_last_seen": "2026-05-18T01:53:39.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--8443b76c-7453-4193-8bd7-652bf27c4be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T01:30:13.817Z",
      "x_nadsec_last_seen": "2026-05-18T01:32:21.417Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--63c09773-d60f-41a8-883c-f717fcc92b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T01:20:40.318Z",
      "x_nadsec_last_seen": "2026-05-18T01:20:40.318Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--97f0c7ae-936e-4beb-9b6d-07f4889a0e0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.74.123.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T01:34:29.060Z",
      "x_nadsec_last_seen": "2026-05-18T01:36:34.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--ed7baeb9-42c5-4555-a3d2-a9043d820abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T02:02:17.970Z",
      "x_nadsec_last_seen": "2026-05-18T02:02:17.970Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-18T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6d9aa3bb-48b2-4d30-8cd9-d483f6c43236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:05:10.000Z",
      "valid_until": "2026-06-19T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T01:39:15.286Z",
      "x_nadsec_last_seen": "2026-05-18T01:39:15.286Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=50670; asn_org=Vtel Holdings Limited/jordan Co.",
      "id": "indicator--c49fbc22-158b-468f-96ee-f00bb139115e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.237.206.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T03:01:13.457Z",
      "x_nadsec_last_seen": "2026-05-18T03:03:20.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "50670"
      ],
      "x_nadsec_orgs": [
        "Vtel Holdings Limited/jordan Co."
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TJ; asn=24722; asn_org=LLC Babilon-T",
      "id": "indicator--b140d464-36cd-42fa-93ad-7a34455abd8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.74.69.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T02:55:59.169Z",
      "x_nadsec_last_seen": "2026-05-18T02:58:06.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TJ"
      ],
      "x_nadsec_asns": [
        "24722"
      ],
      "x_nadsec_orgs": [
        "LLC Babilon-T"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--4a58624a-0bbe-4547-889a-807f727f21ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.67.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T02:17:44.614Z",
      "x_nadsec_last_seen": "2026-05-18T02:17:51.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.107.38.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T02:09:02.506Z",
      "x_nadsec_last_seen": "2026-05-31T05:05:40.521Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--195c265c-ba6e-4c4c-b5a7-e4cb4e62e2a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T02:34:02.990Z",
      "x_nadsec_last_seen": "2026-05-18T02:34:03.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mongod; ports=27017; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.19.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-18T02:24:15.300Z",
      "x_nadsec_last_seen": "2026-05-18T02:27:17.174Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--f76a78e5-db82-4a81-92f2-861bfa0c564d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.100.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T02:19:11.584Z",
      "x_nadsec_last_seen": "2026-05-18T02:19:11.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b124619b-e56c-4884-9d83-175065117ddd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.187.68.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T02:20:42.656Z",
      "x_nadsec_last_seen": "2026-05-18T02:21:16.710Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--855c5336-0a47-4a15-a0b1-96e1ed993175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.190.203.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T02:19:13.369Z",
      "x_nadsec_last_seen": "2026-05-18T02:19:13.369Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--96a815e6-6676-43ee-ad96-fc5c17fa555c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.65.90.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T03:04:39.507Z",
      "x_nadsec_last_seen": "2026-05-18T03:09:08.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AO; asn=37593; asn_org=Infrasat",
      "id": "indicator--ae2830d0-362d-407a-8231-96a56b0c4011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.222.202.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T02:31:46.541Z",
      "x_nadsec_last_seen": "2026-05-18T02:31:46.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AO"
      ],
      "x_nadsec_asns": [
        "37593"
      ],
      "x_nadsec_orgs": [
        "Infrasat"
      ]
    },
    {
      "created": "2026-05-18T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--e6a73315-a61b-49e9-9e8b-d7f3d53d2b8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.43.58.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:05:10.000Z",
      "valid_until": "2026-06-19T03:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-18T02:56:42.865Z",
      "x_nadsec_last_seen": "2026-05-18T04:04:12.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-05-18T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CZ; asn=5610; asn_org=O2 Czech Republic, a.s.",
      "id": "indicator--447f4ce3-8d95-462d-b3ff-37ed4380ecfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.81.125.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:05:05.000Z",
      "valid_until": "2026-06-19T04:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T03:29:52.268Z",
      "x_nadsec_last_seen": "2026-05-18T03:37:04.709Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CZ"
      ],
      "x_nadsec_asns": [
        "5610"
      ],
      "x_nadsec_orgs": [
        "O2 Czech Republic, a.s."
      ]
    },
    {
      "created": "2026-05-18T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0107c02d-4c06-4ea8-8aac-63ffad262f4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:05:05.000Z",
      "valid_until": "2026-06-19T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T03:37:47.301Z",
      "x_nadsec_last_seen": "2026-05-18T03:37:48.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--d371dd09-310d-4251-b7e2-8b3f56f75436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.9.35.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:05:05.000Z",
      "valid_until": "2026-06-19T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T03:44:41.428Z",
      "x_nadsec_last_seen": "2026-05-18T03:44:45.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-18T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--557425d8-e486-4937-9040-a955fab2cb55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.154.1.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:05:05.000Z",
      "valid_until": "2026-06-19T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T03:06:24.250Z",
      "x_nadsec_last_seen": "2026-05-18T03:06:24.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-18T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--0e7489d2-51d3-4095-935e-8f6ea16f0179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.61.48.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:05:05.000Z",
      "valid_until": "2026-06-19T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T03:12:13.773Z",
      "x_nadsec_last_seen": "2026-05-18T03:12:13.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-18T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=61621; asn_org=Norte.Net Telecomunicacoes Ltda; user(top)=**",
      "id": "indicator--4dd4b46a-dff2-47ea-8f98-75c3eb80fc08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.235.163.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:05:05.000Z",
      "valid_until": "2026-06-19T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T03:46:09.286Z",
      "x_nadsec_last_seen": "2026-05-18T03:46:09.286Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61621"
      ],
      "x_nadsec_orgs": [
        "Norte.Net Telecomunicacoes Ltda"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8df8d3a4-1e01-4c94-bca2-e741bc8bc0e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.63.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T05:38:45.797Z",
      "x_nadsec_last_seen": "2026-05-18T05:55:58.346Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=19889; asn_org=Cooperativa Telefonica Del Viso",
      "id": "indicator--4af24852-7d7d-42ed-92a6-f223a1b74c60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.22.24.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-18T05:40:31.071Z",
      "x_nadsec_last_seen": "2026-05-20T08:27:34.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "19889"
      ],
      "x_nadsec_orgs": [
        "Cooperativa Telefonica Del Viso"
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1d2b648b-18ba-47bb-b15d-af0f06695a2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.241.251.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T05:14:34.065Z",
      "x_nadsec_last_seen": "2026-05-18T05:14:34.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4ad1b747-d6cd-495e-9396-745f264f3bae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.63.139.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T05:20:14.112Z",
      "x_nadsec_last_seen": "2026-05-18T05:20:14.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T05:16:21.247Z",
      "x_nadsec_last_seen": "2026-05-18T05:16:21.247Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IQ; asn=206206; asn_org=Kurdistan Net Company for Computer and Internet Ltd.",
      "id": "indicator--37ea87a9-7096-4771-b54a-f7d82a80fc5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.237.124.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T05:20:34.486Z",
      "x_nadsec_last_seen": "2026-05-18T05:27:44.378Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "206206"
      ],
      "x_nadsec_orgs": [
        "Kurdistan Net Company for Computer and Internet Ltd."
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--52b1c114-dbfa-4737-9a0c-1a5f02af55a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.66.23.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T05:59:29.408Z",
      "x_nadsec_last_seen": "2026-05-18T06:01:34.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--6a64770d-437a-4b32-a5f2-ec289be1b39c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.141.241.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T05:40:35.611Z",
      "x_nadsec_last_seen": "2026-05-18T05:42:42.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-18T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--05be283e-b58b-45ed-b62d-e060cceec48a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.251.28.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T06:05:11.000Z",
      "valid_until": "2026-06-19T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T05:41:50.640Z",
      "x_nadsec_last_seen": "2026-05-18T05:48:47.191Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--ec16b206-94d1-4917-867b-fcbf6b228c71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.165.236.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T06:23:27.666Z",
      "x_nadsec_last_seen": "2026-05-18T06:25:32.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--e1975762-486d-4cef-9be6-1103ba7e6a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.4.33.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T06:41:35.488Z",
      "x_nadsec_last_seen": "2026-05-18T06:43:40.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--422762fa-b5fc-4763-ab59-cc7e9fbd7778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.195.121.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T06:08:29.480Z",
      "x_nadsec_last_seen": "2026-05-18T06:08:29.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--3c9cfa0b-9658-4f30-8c3d-f88d103ea4f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.161.190.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T06:37:19.950Z",
      "x_nadsec_last_seen": "2026-05-18T06:37:20.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b73aca7f-353e-443d-9307-c831267aba21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.85.206.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T06:43:14.433Z",
      "x_nadsec_last_seen": "2026-05-18T06:47:45.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC",
      "id": "indicator--9ca8cbcb-4da8-4b4f-a42c-2d9af8bbe8e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.67.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T07:02:43.557Z",
      "x_nadsec_last_seen": "2026-05-18T07:04:50.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200590"
      ],
      "x_nadsec_orgs": [
        "NLS Kazakhstan LLC"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d1cca4ba-7ee7-40bf-8867-b086f1083162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.124.150.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T07:01:59.307Z",
      "x_nadsec_last_seen": "2026-05-18T07:08:14.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-18T07:05:50.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--00b31c02-ab70-46c4-ba1a-4a56a6bffd8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T07:05:50.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.57.215.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:05:50.000Z",
      "valid_until": "2026-06-19T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T06:33:32.767Z",
      "x_nadsec_last_seen": "2026-05-18T06:33:38.948Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--64da3183-88a9-4e6f-a848-ef5c7f49fdc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.241.211.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T08:49:15.348Z",
      "x_nadsec_last_seen": "2026-05-18T08:51:20.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--61c22014-39c2-4895-b1db-5688f8eebc94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.232.2.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T08:11:26.843Z",
      "x_nadsec_last_seen": "2026-05-18T08:14:30.432Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23700; asn_org=Linknet-Fastnet ASN",
      "id": "indicator--97c8a29c-8b7c-4519-92bc-2773cf557c6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.194.57.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T08:09:05.472Z",
      "x_nadsec_last_seen": "2026-05-18T08:11:11.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23700"
      ],
      "x_nadsec_orgs": [
        "Linknet-Fastnet ASN"
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=48; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1d0aeb1b-56fa-48b5-8f54-258a729a578c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.170.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-05-18T09:01:05.801Z",
      "x_nadsec_last_seen": "2026-05-18T09:06:00.990Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=206026; asn_org=Kar-Tel LLC",
      "id": "indicator--6a621d4c-e553-445e-837f-83df2ed7562d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.223.78.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T08:06:04.950Z",
      "x_nadsec_last_seen": "2026-05-18T08:08:11.920Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "206026"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--61b853f1-eeac-4882-bac1-67c2940bdee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.46.139.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-18T08:24:06.857Z",
      "x_nadsec_last_seen": "2026-05-31T06:52:50.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--ce788332-ce8f-4a51-bb14-9e2dcdd8b9d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.89.221.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T08:19:29.784Z",
      "x_nadsec_last_seen": "2026-05-18T08:25:59.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--4f5fb056-baac-4df9-8765-bdf84b8c7cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.147.202.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T08:36:37.529Z",
      "x_nadsec_last_seen": "2026-05-18T08:38:43.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--31a623b5-1d1f-422d-af02-4bfd830997b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.74.252.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T08:37:00.342Z",
      "x_nadsec_last_seen": "2026-05-18T08:39:05.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T09:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a546a458-0790-42fb-807e-976f8a79d761",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T09:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:05:20.000Z",
      "valid_until": "2026-06-19T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T08:08:48.327Z",
      "x_nadsec_last_seen": "2026-05-18T08:08:48.327Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--d44611ed-e469-4c1a-8178-f6ffe830b310",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '108.178.22.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T09:17:08.100Z",
      "x_nadsec_last_seen": "2026-05-18T09:17:08.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RS; asn=15958; asn_org=CETIN Ltd. Belgrade",
      "id": "indicator--9271933b-b039-4fe7-8d49-7709d5c2dd7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.106.238.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T09:58:49.203Z",
      "x_nadsec_last_seen": "2026-05-18T10:00:55.557Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "15958"
      ],
      "x_nadsec_orgs": [
        "CETIN Ltd. Belgrade"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--564025b8-208d-49d7-abff-27bec28557fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.207.148.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T09:48:39.322Z",
      "x_nadsec_last_seen": "2026-05-18T09:50:45.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--74dec2d4-43ef-4811-90ae-2375a8bf9891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.167.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T09:59:34.916Z",
      "x_nadsec_last_seen": "2026-05-18T09:59:35.268Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--5819201e-5960-4c3d-b520-7284f5b809aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.72.21.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T09:58:31.609Z",
      "x_nadsec_last_seen": "2026-05-18T10:00:36.673Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--6809f988-3142-41d6-a3f5-41879ebc003e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.118.72.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T09:44:52.302Z",
      "x_nadsec_last_seen": "2026-05-18T09:49:01.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2475f5a7-2a2c-49f7-8a01-22c61059d4ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T09:09:36.198Z",
      "x_nadsec_last_seen": "2026-05-18T09:09:36.198Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=PL; asn=200730; asn_org=ISAEV Igor",
      "id": "indicator--5d36558c-32a6-4465-8da3-595628929543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 2400,
      "x_nadsec_first_seen": "2026-05-18T09:50:41.582Z",
      "x_nadsec_last_seen": "2026-05-31T23:54:01.555Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "200730"
      ],
      "x_nadsec_orgs": [
        "ISAEV Igor"
      ]
    },
    {
      "created": "2026-05-18T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--22c96740-3cc3-4ded-adb5-0e2934e0b1fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.223.108.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T10:05:10.000Z",
      "valid_until": "2026-06-19T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T09:30:27.306Z",
      "x_nadsec_last_seen": "2026-05-18T09:36:56.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-18T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--00c47b0a-e22d-420c-9282-34960a719b02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.68.105.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:05:10.000Z",
      "valid_until": "2026-06-19T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T10:45:33.905Z",
      "x_nadsec_last_seen": "2026-05-18T10:50:15.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-05-18T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--a754fe84-1f50-4a56-b24d-6abaf078e699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.204.9.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:05:10.000Z",
      "valid_until": "2026-06-19T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T10:58:32.892Z",
      "x_nadsec_last_seen": "2026-05-18T11:00:38.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-18T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--817d15e6-f492-4089-aa82-851062c9e2a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.6.97.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:05:10.000Z",
      "valid_until": "2026-06-19T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T10:34:51.970Z",
      "x_nadsec_last_seen": "2026-05-18T10:34:57.134Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--7364d9ce-f4ef-4b8a-b570-6b01fe682cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.92.51.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:05:10.000Z",
      "valid_until": "2026-06-19T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T10:13:32.747Z",
      "x_nadsec_last_seen": "2026-05-18T10:20:04.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-18T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--29591884-a053-4e89-8d6f-274cb261ad70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:05:10.000Z",
      "valid_until": "2026-06-19T11:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-18T10:14:42.991Z",
      "x_nadsec_last_seen": "2026-05-20T14:13:21.168Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-05-18T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IL; asn=12400; asn_org=Partner Communications Ltd.",
      "id": "indicator--28767321-1c28-4d17-86be-eed6da0bbb51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.228.233.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:05:10.000Z",
      "valid_until": "2026-06-19T11:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-18T10:55:44.713Z",
      "x_nadsec_last_seen": "2026-05-23T05:11:28.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ]
    },
    {
      "created": "2026-05-18T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--9bd2fff4-406e-4df0-9c4b-42622284225c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.67.49.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:05:10.000Z",
      "valid_until": "2026-06-19T12:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T11:13:12.318Z",
      "x_nadsec_last_seen": "2026-05-18T11:19:58.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-18T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--4961d068-9e1b-4d84-9885-49dba7c118df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.135.217.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:05:10.000Z",
      "valid_until": "2026-06-19T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T11:39:30.022Z",
      "x_nadsec_last_seen": "2026-05-18T11:41:36.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-18T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c44e2a94-ba97-4224-9412-f27e6c61ed95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:05:10.000Z",
      "valid_until": "2026-06-19T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T11:20:14.151Z",
      "x_nadsec_last_seen": "2026-05-18T11:20:24.360Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--205aa2e1-f21c-4396-a83a-111e14da9e3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.212.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:05:10.000Z",
      "valid_until": "2026-06-19T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T11:17:54.119Z",
      "x_nadsec_last_seen": "2026-05-18T11:17:54.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-18T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8cd7c687-b659-462e-b2c8-0a0755e7851c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.79.25.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:05:10.000Z",
      "valid_until": "2026-06-19T12:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-18T11:51:14.826Z",
      "x_nadsec_last_seen": "2026-05-19T07:30:31.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=272854; asn_org=TELECOMUNICACIONES SILVERDATA, C.A.",
      "id": "indicator--27903e0c-5781-4b2b-a7f3-edecae02da4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.195.12.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:05:10.000Z",
      "valid_until": "2026-06-19T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T11:22:07.946Z",
      "x_nadsec_last_seen": "2026-05-18T11:24:14.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "272854"
      ],
      "x_nadsec_orgs": [
        "TELECOMUNICACIONES SILVERDATA, C.A."
      ]
    },
    {
      "created": "2026-05-18T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=210135; asn_org=Yug-Telecom-K Ltd.",
      "id": "indicator--a7b13c8e-2af9-41ae-ab62-6b18e5608fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.180.19.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T12:05:10.000Z",
      "valid_until": "2026-06-19T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T11:24:05.133Z",
      "x_nadsec_last_seen": "2026-05-18T11:25:29.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210135"
      ],
      "x_nadsec_orgs": [
        "Yug-Telecom-K Ltd."
      ]
    },
    {
      "created": "2026-05-18T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=58656; asn_org=bdHUB Limited",
      "id": "indicator--04939fe4-f850-47be-911b-b11cf3f8c85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.179.16.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:05:32.000Z",
      "valid_until": "2026-06-19T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T12:54:54.809Z",
      "x_nadsec_last_seen": "2026-05-18T12:57:00.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "58656"
      ],
      "x_nadsec_orgs": [
        "bdHUB Limited"
      ]
    },
    {
      "created": "2026-05-18T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--3b655385-efc0-4d3d-b818-27d9140eab16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.170.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:05:32.000Z",
      "valid_until": "2026-06-19T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T12:21:31.829Z",
      "x_nadsec_last_seen": "2026-05-18T12:28:46.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-18T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:05:32.000Z",
      "valid_until": "2026-06-19T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T12:44:36.076Z",
      "x_nadsec_last_seen": "2026-05-23T15:06:06.436Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-05-18T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=BR; asn=265175; asn_org=AS SISTEMAS LTDA",
      "id": "indicator--02d6f195-7091-4d53-a3cb-dc44bbd05068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.84.42.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:05:32.000Z",
      "valid_until": "2026-06-19T13:05:09.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-05-18T12:11:39.523Z",
      "x_nadsec_last_seen": "2026-05-18T12:16:10.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265175"
      ],
      "x_nadsec_orgs": [
        "AS SISTEMAS LTDA"
      ]
    },
    {
      "created": "2026-05-18T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9de6679a-b550-4050-84ee-550928b91958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:05:32.000Z",
      "valid_until": "2026-06-19T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T12:22:00.789Z",
      "x_nadsec_last_seen": "2026-05-23T09:32:55.356Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-18T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=56293; asn_org=Kewiko LLC",
      "id": "indicator--ee600995-93dc-4e43-8cc6-ca92462fe9e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.10.23.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:05:12.000Z",
      "valid_until": "2026-06-19T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T13:21:54.573Z",
      "x_nadsec_last_seen": "2026-05-18T13:24:01.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "56293"
      ],
      "x_nadsec_orgs": [
        "Kewiko LLC"
      ]
    },
    {
      "created": "2026-05-18T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--29da8f96-57b6-445f-bf1b-7be95a2a563e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.46.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:05:12.000Z",
      "valid_until": "2026-06-19T14:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-18T13:35:21.726Z",
      "x_nadsec_last_seen": "2026-05-22T06:07:36.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-18T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a1317c7b-4526-4a13-b955-2046d074d393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.95.219.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:05:12.000Z",
      "valid_until": "2026-06-19T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T13:45:06.073Z",
      "x_nadsec_last_seen": "2026-05-18T13:45:06.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-18T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--cccc4f4c-8874-4993-b813-2a0190e83f70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.33.105.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:05:12.000Z",
      "valid_until": "2026-06-19T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T13:51:16.835Z",
      "x_nadsec_last_seen": "2026-05-18T13:53:23.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-18T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6aca70a6-537f-45ae-a521-0bb2327c7072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:05:12.000Z",
      "valid_until": "2026-06-19T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T13:34:27.417Z",
      "x_nadsec_last_seen": "2026-05-29T21:41:14.922Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-18T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=28787; asn_org=Aztelekom LLC; user(top)=**",
      "id": "indicator--8974ae26-4c27-4b9c-9ba1-812ae390d665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.17.88.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:05:12.000Z",
      "valid_until": "2026-06-19T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T13:07:21.926Z",
      "x_nadsec_last_seen": "2026-05-18T13:07:21.926Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "28787"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--c57f2456-f8dd-471d-ab11-63b83c52552e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.98.213.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:05:12.000Z",
      "valid_until": "2026-06-19T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T14:00:38.582Z",
      "x_nadsec_last_seen": "2026-05-18T14:02:44.858Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1687db26-60b4-426c-ab69-5810ac8d9327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.173.48.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T15:00:14.690Z",
      "x_nadsec_last_seen": "2026-05-18T15:06:45.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JP; asn=137409; asn_org=GSL Networks Pty LTD; user(top)=**",
      "id": "indicator--595e5db7-bc7a-4793-ab4d-7e3cb687f20e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.62.49.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T15:52:44.595Z",
      "x_nadsec_last_seen": "2026-05-18T15:52:44.595Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "137409"
      ],
      "x_nadsec_orgs": [
        "GSL Networks Pty LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--563081ad-ca09-4901-a822-294afba1149c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.251.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-18T15:45:13.877Z",
      "x_nadsec_last_seen": "2026-05-18T15:45:58.588Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52772; asn_org=SJNET TELECOMUNICACOES - EIRELI",
      "id": "indicator--e70a6b09-894f-437a-9d8a-2a8214fa87c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.39.159.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T15:25:46.189Z",
      "x_nadsec_last_seen": "2026-05-18T15:25:52.991Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52772"
      ],
      "x_nadsec_orgs": [
        "SJNET TELECOMUNICACOES - EIRELI"
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--569963f0-7289-4610-b3d9-edfce77dc5fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.95.31.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T15:09:07.351Z",
      "x_nadsec_last_seen": "2026-05-18T15:11:13.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e6a883d7-bae9-4ca1-8304-8de461f4afc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.106.32.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T15:57:01.058Z",
      "x_nadsec_last_seen": "2026-05-19T19:19:16.108Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f628e081-0c46-464c-9158-706f27ce473f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T15:40:53.883Z",
      "x_nadsec_last_seen": "2026-05-18T15:40:54.266Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T16:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=20473; asn_org=The Constant Company, LLC",
      "id": "indicator--b8851fc8-4cb4-4063-917f-9f6e13251232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T16:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.141.210.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:05:11.000Z",
      "valid_until": "2026-06-19T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T15:45:37.187Z",
      "x_nadsec_last_seen": "2026-05-18T15:45:37.187Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "20473"
      ],
      "x_nadsec_orgs": [
        "The Constant Company, LLC"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--154ce8af-eedd-4ea5-ae2b-e46003bed7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:30:02.278Z",
      "x_nadsec_last_seen": "2026-05-18T16:30:02.278Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=32; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c2dbeb3b-6111-4607-9eae-4ea62c0963b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.142.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-05-18T16:37:18.901Z",
      "x_nadsec_last_seen": "2026-05-18T16:38:10.032Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--4693dad0-d687-4cb5-8a7b-8a4aa5d5cfaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.255.233.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:33:39.510Z",
      "x_nadsec_last_seen": "2026-05-18T16:33:39.510Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=22085; asn_org=Claro SA",
      "id": "indicator--3b830e93-11fc-4cc3-9544-5fe86afa24ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.94.203.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T17:03:42.670Z",
      "x_nadsec_last_seen": "2026-05-18T17:11:04.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "22085"
      ],
      "x_nadsec_orgs": [
        "Claro SA"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--d906ec8c-9a08-41bd-b9d8-378b3e623153",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:09:20.909Z",
      "x_nadsec_last_seen": "2026-05-18T16:09:20.909Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--95002d36-efa6-44df-ab7a-5b53e9627ed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.58.111.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-18T16:37:15.177Z",
      "x_nadsec_last_seen": "2026-05-18T16:38:10.278Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--52dc0fb7-3e34-490e-834e-e93750ec2305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:09:41.963Z",
      "x_nadsec_last_seen": "2026-05-18T16:09:41.963Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2ace7b34-9b34-4081-8b4b-cadac491a644",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.220.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:18:10.444Z",
      "x_nadsec_last_seen": "2026-05-18T16:18:10.444Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:59:11.810Z",
      "x_nadsec_last_seen": "2026-05-18T16:59:11.810Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--383f3148-2476-4e09-90fb-443732cd8816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.144.99.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:33:39.647Z",
      "x_nadsec_last_seen": "2026-05-18T16:33:39.647Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0dc849ed-e1ab-4ac2-9cc6-432b636c1437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.252.177.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T17:02:25.886Z",
      "x_nadsec_last_seen": "2026-05-18T17:02:26.028Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:13:03.593Z",
      "x_nadsec_last_seen": "2026-05-18T16:13:03.593Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--7a216106-3b1f-4617-ab31-a4d66c4d7f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.187.211.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T16:31:40.999Z",
      "x_nadsec_last_seen": "2026-05-18T16:31:40.999Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--47aea7a3-ece2-4494-93e0-57c413d20e45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.150.234.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T16:56:34.497Z",
      "x_nadsec_last_seen": "2026-05-18T16:58:40.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-18T17:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--772315ca-1903-421c-be56-8d23823f0b10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T17:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.112.46.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:05:23.000Z",
      "valid_until": "2026-06-19T17:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-18T17:01:11.396Z",
      "x_nadsec_last_seen": "2026-05-18T17:02:58.220Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-05-18T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5ba3bda3-037a-4bff-95b9-b3504704fa39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.82.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:05:11.000Z",
      "valid_until": "2026-06-19T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T18:03:16.519Z",
      "x_nadsec_last_seen": "2026-05-18T18:05:23.945Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-18T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--91d21909-f5c4-41fa-8657-fc13b0b25537",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.252.75.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:05:11.000Z",
      "valid_until": "2026-06-19T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-18T17:09:21.885Z",
      "x_nadsec_last_seen": "2026-05-18T17:16:07.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-18T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--fa335703-0ecf-48c3-9c20-89194ed911d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.252.235.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T18:05:11.000Z",
      "valid_until": "2026-06-19T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-18T18:02:25.009Z",
      "x_nadsec_last_seen": "2026-05-18T18:18:46.351Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--00664deb-8818-4f22-901e-0b920d34eeba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.248.67.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T18:23:17.339Z",
      "x_nadsec_last_seen": "2026-05-18T18:23:17.339Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--fc60f922-8181-4427-a345-cbe5bcd2e781",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.112.24.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T18:51:28.362Z",
      "x_nadsec_last_seen": "2026-05-18T18:51:30.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a86cfaad-aa57-46f7-ab3e-eedb6b562601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.65.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-18T18:37:37.250Z",
      "x_nadsec_last_seen": "2026-05-18T18:38:31.701Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0610563b-da3b-49c1-9d6c-f415aa573ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T18:13:36.441Z",
      "x_nadsec_last_seen": "2026-05-18T18:13:36.441Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4d9e76a1-dd07-4740-a03f-af92a1412b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.150.193.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T18:52:57.888Z",
      "x_nadsec_last_seen": "2026-05-18T18:52:57.888Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--03cc9f05-42f4-4665-8273-1cb772c9eada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.135.170.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T18:05:34.249Z",
      "x_nadsec_last_seen": "2026-05-18T18:05:34.249Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T18:11:11.815Z",
      "x_nadsec_last_seen": "2026-05-18T18:11:11.815Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-18T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48190; asn_org=T2 Mobile LLC",
      "id": "indicator--5325b9ae-1809-48d7-b97b-1049c4fcbd4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.253.6.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T19:05:10.000Z",
      "valid_until": "2026-06-19T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T18:27:18.583Z",
      "x_nadsec_last_seen": "2026-05-18T18:27:25.807Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48190"
      ],
      "x_nadsec_orgs": [
        "T2 Mobile LLC"
      ]
    },
    {
      "created": "2026-05-18T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=262807; asn_org=Redfox Telecomunicacoes Ltda.; user(top)=**",
      "id": "indicator--fdee1ee9-5f56-497e-a59e-3d80ac8aaf45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.250.52.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:05:05.000Z",
      "valid_until": "2026-06-19T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T19:12:01.410Z",
      "x_nadsec_last_seen": "2026-05-18T19:12:01.410Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262807"
      ],
      "x_nadsec_orgs": [
        "Redfox Telecomunicacoes Ltda."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--88edff78-d04d-479e-8b16-324f5013c4a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.187.43.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:05:05.000Z",
      "valid_until": "2026-06-19T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T19:19:15.496Z",
      "x_nadsec_last_seen": "2026-05-18T19:19:15.496Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--aca6e578-fbec-478c-8859-7ba30968e86d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:05:05.000Z",
      "valid_until": "2026-06-19T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T20:04:45.071Z",
      "x_nadsec_last_seen": "2026-05-18T20:04:45.071Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-18T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=RU; asn=34665; asn_org=Petersburg Internet Network ltd.",
      "id": "indicator--b49db0f2-9f22-47bd-bf0d-f0b98c7cde43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.161.50.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:05:05.000Z",
      "valid_until": "2026-06-19T20:05:03.000Z",
      "x_nadsec_event_count": 71,
      "x_nadsec_first_seen": "2026-05-18T19:40:18.691Z",
      "x_nadsec_last_seen": "2026-05-31T15:33:34.125Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34665"
      ],
      "x_nadsec_orgs": [
        "Petersburg Internet Network ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--4b87745a-022a-4bae-b4cc-a0a76fbaa67d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.32.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:05:05.000Z",
      "valid_until": "2026-06-19T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T19:28:08.675Z",
      "x_nadsec_last_seen": "2026-05-18T19:28:08.675Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-18T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--9cc2d274-5e0c-4586-aca3-217cb67ac67b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.74.41.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T20:05:05.000Z",
      "valid_until": "2026-06-19T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T19:56:46.499Z",
      "x_nadsec_last_seen": "2026-05-18T19:56:46.499Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:05:10.000Z",
      "valid_until": "2026-06-19T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T20:52:33.825Z",
      "x_nadsec_last_seen": "2026-05-18T20:52:33.825Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c3a3b5d1-cbeb-4c40-9167-ad903338713f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:05:10.000Z",
      "valid_until": "2026-06-19T21:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-18T20:49:20.363Z",
      "x_nadsec_last_seen": "2026-05-18T20:50:10.270Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NI; asn=267797; asn_org=EMPRESA NACIONAL DE TRANSMISION ELECTRICA ENATREL; user(top)=**",
      "id": "indicator--600f4802-8243-4977-9e22-485013ba915b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.98.12.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:05:10.000Z",
      "valid_until": "2026-06-19T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T20:37:35.022Z",
      "x_nadsec_last_seen": "2026-05-18T20:37:35.022Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NI"
      ],
      "x_nadsec_asns": [
        "267797"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TRANSMISION ELECTRICA ENATREL"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--eb7f8574-0c06-495d-91cc-2792d83d8b7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.189.146.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:05:10.000Z",
      "valid_until": "2026-06-19T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T20:39:26.774Z",
      "x_nadsec_last_seen": "2026-05-18T20:41:32.022Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "17072"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--471facca-9c40-4c12-b8af-72360e6ae529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:05:10.000Z",
      "valid_until": "2026-06-19T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T20:21:22.312Z",
      "x_nadsec_last_seen": "2026-05-18T20:21:22.312Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--168f4d0b-f3c4-4d8a-8be4-511cf402c439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.12.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T21:05:10.000Z",
      "valid_until": "2026-06-19T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T20:53:46.306Z",
      "x_nadsec_last_seen": "2026-05-18T20:54:04.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9226a66c-397b-415e-bfff-c36bed92b0df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.150.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T21:36:05.400Z",
      "x_nadsec_last_seen": "2026-05-18T21:56:39.954Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--af613487-6e65-452f-a176-be1808c65375",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.75.1.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-18T21:55:48.787Z",
      "x_nadsec_last_seen": "2026-05-18T21:57:41.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=134765; asn_org=CHINANET Yunnan province IDC1 network; user(top)=**",
      "id": "indicator--260d58a8-801f-4775-8658-40ca11c9ca5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.55.229.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T21:39:46.553Z",
      "x_nadsec_last_seen": "2026-05-18T21:39:46.553Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134765"
      ],
      "x_nadsec_orgs": [
        "CHINANET Yunnan province IDC1 network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--5d0ef1b9-982c-4c64-8097-fa19560ab64f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.241.76.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T21:30:22.275Z",
      "x_nadsec_last_seen": "2026-05-18T21:32:27.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--897fe569-f9d1-400b-b0ae-2e35791bf228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T21:56:05.352Z",
      "x_nadsec_last_seen": "2026-05-31T17:31:39.035Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--673d1a33-127e-4852-8891-e68352532d07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.40.250.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T21:47:12.289Z",
      "x_nadsec_last_seen": "2026-05-18T21:47:22.463Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--45912d80-8be7-4767-a15c-efe264ae72ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.199.144.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T21:08:47.225Z",
      "x_nadsec_last_seen": "2026-05-18T21:10:54.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=265691; asn_org=WI-NET TELECOM S.A.C.",
      "id": "indicator--ca0825b9-4dd6-4809-b53d-4e0d0eecee0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.25.40.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T21:30:25.787Z",
      "x_nadsec_last_seen": "2026-05-18T21:30:25.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "265691"
      ],
      "x_nadsec_orgs": [
        "WI-NET TELECOM S.A.C."
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3b0d852c-e7bd-4dc7-baf5-78f265ada713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T21:14:13.483Z",
      "x_nadsec_last_seen": "2026-05-18T21:14:13.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-18T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8e3630cb-86e6-41f3-bd42-be4ed94b8503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T22:05:10.000Z",
      "valid_until": "2026-06-19T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T21:14:14.008Z",
      "x_nadsec_last_seen": "2026-05-18T21:14:14.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-18T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--c4409c9d-2a3e-42f5-9fab-9d2f0713fcae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-18T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.80.228.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T23:05:10.000Z",
      "valid_until": "2026-06-19T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T22:28:29.410Z",
      "x_nadsec_last_seen": "2026-05-18T22:28:29.410Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-05-19T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45184; asn_org=Den Digital Entertainment Pvt. Ltd. AS ISP india",
      "id": "indicator--ff25a2c9-1c6f-4855-a1c0-f1a9c746f9fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.89.73.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:05:10.000Z",
      "valid_until": "2026-06-20T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T23:21:20.196Z",
      "x_nadsec_last_seen": "2026-05-18T23:23:25.144Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45184"
      ],
      "x_nadsec_orgs": [
        "Den Digital Entertainment Pvt. Ltd. AS ISP india"
      ]
    },
    {
      "created": "2026-05-19T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--85a4f58d-8768-4cd4-9ad0-51cd2d3b516f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.20.141.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:05:10.000Z",
      "valid_until": "2026-06-20T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-18T23:27:49.099Z",
      "x_nadsec_last_seen": "2026-05-18T23:27:49.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-19T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--93df145b-9e6d-4e4d-acad-f83829f9397a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:05:10.000Z",
      "valid_until": "2026-06-20T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T00:03:26.568Z",
      "x_nadsec_last_seen": "2026-05-19T00:04:34.105Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-19T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--3e75ca62-bdb1-4ff1-9d2c-efc5e66c084b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.248.10.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:05:10.000Z",
      "valid_until": "2026-06-20T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T02:05:13.936Z",
      "x_nadsec_last_seen": "2026-05-18T23:49:26.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-05-19T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=8359; asn_org=MTS PJSC; user(top)=**",
      "id": "indicator--2b4af062-2e10-4ccb-9883-1ae10c40711e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.237.72.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T00:05:10.000Z",
      "valid_until": "2026-06-20T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-18T23:23:43.776Z",
      "x_nadsec_last_seen": "2026-05-18T23:23:43.776Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T01:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--bf44a73e-62b3-477f-86a9-ef69bd3b141d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.183.171.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:05:16.000Z",
      "valid_until": "2026-06-20T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T00:56:22.761Z",
      "x_nadsec_last_seen": "2026-05-19T01:02:48.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-19T01:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--6edf90db-c1a0-4fae-aa3d-c00fc65e26d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.208.191.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:05:16.000Z",
      "valid_until": "2026-06-20T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T00:59:49.228Z",
      "x_nadsec_last_seen": "2026-05-19T00:59:49.228Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-19T01:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--fcdbaa71-e088-49a2-9ee1-b11c51c7cba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.2.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:05:16.000Z",
      "valid_until": "2026-06-20T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T00:25:19.016Z",
      "x_nadsec_last_seen": "2026-05-19T00:27:24.755Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-19T01:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--d9335108-ebbd-4acc-b060-559ded4972aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.167.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:05:16.000Z",
      "valid_until": "2026-06-20T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T00:19:16.830Z",
      "x_nadsec_last_seen": "2026-05-19T00:21:23.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-19T01:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--81697947-7faf-443a-8bc1-d7634ffa741f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:05:16.000Z",
      "valid_until": "2026-06-20T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T00:07:01.929Z",
      "x_nadsec_last_seen": "2026-05-19T00:07:02.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-19T01:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b2af1522-8184-4c4a-9880-8eebaf52e475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T01:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.103.171.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:05:16.000Z",
      "valid_until": "2026-06-20T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T00:16:41.966Z",
      "x_nadsec_last_seen": "2026-05-19T00:18:49.313Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--764541c8-ecce-4c36-8e7e-4fab58218772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.49.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T01:40:23.343Z",
      "x_nadsec_last_seen": "2026-05-19T01:46:40.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=134756; asn_org=CHINANET Nanjing Jishan IDC network",
      "id": "indicator--5b4475c4-6a6f-498e-9153-30f8ec462c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.89.185.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T01:38:19.494Z",
      "x_nadsec_last_seen": "2026-05-19T01:38:19.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134756"
      ],
      "x_nadsec_orgs": [
        "CHINANET Nanjing Jishan IDC network"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--27378944-80ad-4226-9b0f-a42a5a55410e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.93.151.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-19T01:28:27.983Z",
      "x_nadsec_last_seen": "2026-05-19T01:30:28.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=263244; asn_org=Iperactive SA",
      "id": "indicator--7de9dc9c-7e4e-4111-abe4-1adbbc3774a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.0.181.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T02:00:38.624Z",
      "x_nadsec_last_seen": "2026-05-19T02:02:45.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "263244"
      ],
      "x_nadsec_orgs": [
        "Iperactive SA"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=81; services=smbd; ports=445; cc=AZ; asn=28787; asn_org=Aztelekom LLC",
      "id": "indicator--8e92e14e-fc50-4753-94ad-b814881b3db6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.253.212.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 1140,
      "x_nadsec_first_seen": "2026-05-19T01:58:46.466Z",
      "x_nadsec_last_seen": "2026-05-19T10:22:44.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "28787"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=66; services=smbd; ports=445; cc=AZ; asn=28787; asn_org=Aztelekom LLC",
      "id": "indicator--07a79415-4b56-46c8-9b88-7b16c2e2a764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.253.221.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 1149,
      "x_nadsec_first_seen": "2026-05-19T01:58:47.219Z",
      "x_nadsec_last_seen": "2026-05-19T10:22:46.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "28787"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--4248f74c-93b0-472f-8306-17b23fd96900",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.186.162.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T01:42:21.110Z",
      "x_nadsec_last_seen": "2026-05-19T01:49:30.301Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--ceaaa541-4872-4af6-b4ad-b821786a37ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.76.8.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T01:41:46.509Z",
      "x_nadsec_last_seen": "2026-05-19T01:41:47.773Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--48011dee-8c5c-4607-a9c0-3ba583eb61f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.56.193.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T01:46:35.974Z",
      "x_nadsec_last_seen": "2026-05-19T01:55:26.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-19T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35598; asn_org=Inetcom Carrier LLC",
      "id": "indicator--0d6a3d8e-d05b-4c80-84a2-1060781a3af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.239.25.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:05:11.000Z",
      "valid_until": "2026-06-20T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T01:40:04.939Z",
      "x_nadsec_last_seen": "2026-05-19T01:47:28.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35598"
      ],
      "x_nadsec_orgs": [
        "Inetcom Carrier LLC"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--4398a595-0704-4b0b-9f85-2e57e02f239e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.186.149.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T02:21:01.175Z",
      "x_nadsec_last_seen": "2026-05-19T02:23:06.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--3c5dc759-6b49-404b-a921-e8296cb88cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.16.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T02:30:23.660Z",
      "x_nadsec_last_seen": "2026-05-19T02:37:39.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--efb4d367-5778-4005-aa87-e5534f1770eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T02:32:07.337Z",
      "x_nadsec_last_seen": "2026-05-19T02:32:07.337Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cf4a5ed7-7a52-4528-a0f8-7b22fae21d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.98.128.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T02:46:35.643Z",
      "x_nadsec_last_seen": "2026-05-19T02:46:35.643Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f63bd928-4693-4b3f-a923-35ea8e19c432",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.220.110.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T03:01:13.471Z",
      "x_nadsec_last_seen": "2026-05-19T03:02:31.722Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9ed83733-51e4-4c83-8dde-ff30478c5ec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.92.18.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-19T02:30:24.109Z",
      "x_nadsec_last_seen": "2026-05-26T13:49:31.003Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--23a8aaa0-6652-4228-a9a9-7da79856ee06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.36.23.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-19T02:53:40.978Z",
      "x_nadsec_last_seen": "2026-05-19T03:46:43.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2ed3ed07-c19e-40eb-8e47-0ce2d82ad92f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T02:31:24.585Z",
      "x_nadsec_last_seen": "2026-05-26T02:13:52.327Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-19T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:05:10.000Z",
      "valid_until": "2026-06-20T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T02:12:36.563Z",
      "x_nadsec_last_seen": "2026-05-19T02:12:36.563Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134021; asn_org=Airgenie Communications Private Limited",
      "id": "indicator--ea3bc83c-de2f-4d11-996d-9393538063ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.96.47.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-19T03:09:29.899Z",
      "x_nadsec_last_seen": "2026-05-27T01:08:29.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134021"
      ],
      "x_nadsec_orgs": [
        "Airgenie Communications Private Limited"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NP; asn=24550; asn_org=Websurfer Nepal Internet Service Provider",
      "id": "indicator--dda73ac3-543f-468f-976e-26b36ad5ac2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.90.230.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T04:00:52.395Z",
      "x_nadsec_last_seen": "2026-05-19T04:02:57.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "24550"
      ],
      "x_nadsec_orgs": [
        "Websurfer Nepal Internet Service Provider"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--47da057f-6439-4f6b-a167-0fb537881bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.2.75.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T03:32:17.930Z",
      "x_nadsec_last_seen": "2026-05-19T03:34:22.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=PH; asn=132199; asn_org=Globe Telecom Inc.",
      "id": "indicator--5e2ea73a-059e-4ba7-851b-20515163decf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.28.115.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-19T03:24:34.063Z",
      "x_nadsec_last_seen": "2026-05-19T03:24:40.733Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "132199"
      ],
      "x_nadsec_orgs": [
        "Globe Telecom Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e60bd628-3522-4ba8-b33a-41806714502c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.225.78.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T03:55:54.683Z",
      "x_nadsec_last_seen": "2026-05-19T03:55:54.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--10f9cd10-7f84-4367-b750-59f1f9764d6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.225.78.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T03:55:59.402Z",
      "x_nadsec_last_seen": "2026-05-19T03:55:59.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1705ccc0-7b0f-4ead-bd52-f9623ef45c71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.225.78.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T03:55:54.987Z",
      "x_nadsec_last_seen": "2026-05-19T03:55:54.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--62f6a5ab-674f-44ec-878e-560293581de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.231.242.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T03:24:25.705Z",
      "x_nadsec_last_seen": "2026-05-19T03:31:01.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T03:34:47.053Z",
      "x_nadsec_last_seen": "2026-05-19T03:34:47.053Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.130.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-19T03:43:36.757Z",
      "x_nadsec_last_seen": "2026-05-19T03:47:40.365Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017",
        "37013"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--5707eac2-920a-4878-b6ee-4f3c1da92462",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.116.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-19T03:45:31.210Z",
      "x_nadsec_last_seen": "2026-05-23T03:16:07.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=23106; asn_org=AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT",
      "id": "indicator--34baca9e-571a-4430-854b-b0356a740ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.248.99.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T03:27:43.153Z",
      "x_nadsec_last_seen": "2026-05-19T03:29:50.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "23106"
      ],
      "x_nadsec_orgs": [
        "AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3d53ff89-272e-4a0a-b1d0-e5b85cb284fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.60.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T03:53:44.132Z",
      "x_nadsec_last_seen": "2026-05-19T03:53:44.132Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--57753c1c-346b-46ac-94be-e1b80db4c456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.22.249.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T03:07:50.922Z",
      "x_nadsec_last_seen": "2026-05-19T03:09:58.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--0142405f-a44b-4e91-b114-54d07f5b8c1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.32.177.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T03:50:09.075Z",
      "x_nadsec_last_seen": "2026-05-19T03:50:09.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-19T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--f58f264a-b513-4cf0-86b9-0e5069424887",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.244.153.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:05:10.000Z",
      "valid_until": "2026-06-20T04:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-19T03:40:31.669Z",
      "x_nadsec_last_seen": "2026-05-24T00:26:30.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8cd9772e-cc2a-4e1b-ac74-47fbd5306884",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.176.112.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T04:57:38.399Z",
      "x_nadsec_last_seen": "2026-05-19T05:31:04.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=55990; asn_org=Huawei Cloud Service data center; user(top)=**; pass(top)=***",
      "id": "indicator--0605e823-11a3-4892-9867-5d183f959174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.204.97.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T05:03:52.727Z",
      "x_nadsec_last_seen": "2026-05-19T05:03:52.727Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "55990"
      ],
      "x_nadsec_orgs": [
        "Huawei Cloud Service data center"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b4a29996-55a6-4a2f-ae33-a6da3b5d09bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.164.86.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T04:19:43.104Z",
      "x_nadsec_last_seen": "2026-05-19T04:19:43.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--106763b6-5151-4fe8-9ade-130253eaff16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.97.17.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T04:36:14.347Z",
      "x_nadsec_last_seen": "2026-05-19T04:42:59.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--12dd3f77-c782-46e4-b17a-bc641d12dff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.243.167.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T04:42:13.122Z",
      "x_nadsec_last_seen": "2026-05-19T04:42:13.626Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b81581cd-e0f8-4653-a477-5d172f6adc3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.201.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T04:42:20.320Z",
      "x_nadsec_last_seen": "2026-05-19T04:42:21.437Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--29fe10e4-1cda-42e4-b651-99746bf18c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.177.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T04:30:27.532Z",
      "x_nadsec_last_seen": "2026-05-19T04:30:27.532Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--a74a2c25-54d1-4261-bb0a-f2bc800cf30e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.41.187.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T04:40:26.185Z",
      "x_nadsec_last_seen": "2026-05-19T04:42:34.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10834"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5c4163cd-1cc7-43ed-9525-e5fa895646dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.79.207.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T04:19:37.636Z",
      "x_nadsec_last_seen": "2026-05-19T04:19:37.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--cb37e2a5-c488-4618-b3ed-04bf6a7092c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.82.120.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T04:19:37.859Z",
      "x_nadsec_last_seen": "2026-05-19T04:19:41.983Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=FR; asn=12322; asn_org=Free SAS",
      "id": "indicator--b373d794-097e-4d26-933c-fc56df17762c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.66.82.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T04:20:42.734Z",
      "x_nadsec_last_seen": "2026-05-19T04:27:53.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12322"
      ],
      "x_nadsec_orgs": [
        "Free SAS"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BE; asn=47377; asn_org=Orange Belgium SA",
      "id": "indicator--8654fd9c-7fa0-45fc-a46e-b4d90ec85351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.107.202.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T04:07:57.978Z",
      "x_nadsec_last_seen": "2026-05-19T04:10:04.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "47377"
      ],
      "x_nadsec_orgs": [
        "Orange Belgium SA"
      ]
    },
    {
      "created": "2026-05-19T05:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=136393; asn_org=Symphony Communication Thailand PCL.",
      "id": "indicator--0c7e0680-0acb-4254-b7f9-d1bde0e7ecde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T05:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '96.30.68.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:05:05.000Z",
      "valid_until": "2026-06-20T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T05:04:28.606Z",
      "x_nadsec_last_seen": "2026-05-19T05:06:32.970Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "136393"
      ],
      "x_nadsec_orgs": [
        "Symphony Communication Thailand PCL."
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--100b4fd4-050d-4aee-abbb-02989146d175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.200.103.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T05:23:58.125Z",
      "x_nadsec_last_seen": "2026-05-19T05:26:02.760Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--3e2d1762-072c-45e5-ba3a-2fd7c4e44ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.250.13.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T06:01:28.524Z",
      "x_nadsec_last_seen": "2026-05-19T06:03:35.244Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a7893a18-18d0-42a9-806c-df0dd851fd69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.161.28.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T05:11:23.640Z",
      "x_nadsec_last_seen": "2026-05-19T05:13:29.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T06:00:20.027Z",
      "x_nadsec_last_seen": "2026-05-30T17:37:03.379Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--5fe247b9-4419-41b1-ab83-0ee93a539fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.91.4.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T05:56:34.686Z",
      "x_nadsec_last_seen": "2026-05-19T05:58:39.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--f5a58987-0084-4ec7-bef8-94e25d9c1fde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.137.75.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-13T02:13:55.843Z",
      "x_nadsec_last_seen": "2026-05-19T05:58:21.270Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=I*****@",
      "id": "indicator--5c730cda-fe9a-4a25-a8c3-ca7d2fc8e966",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.150.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T06:02:56.859Z",
      "x_nadsec_last_seen": "2026-05-19T06:03:51.786Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--18abc6e3-a900-489c-8781-1fd737a515e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.120.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T06:02:54.434Z",
      "x_nadsec_last_seen": "2026-05-19T06:02:54.434Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5d5cfaa0-69e8-47ce-b111-e4174ccbc585",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.195.222.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T06:03:26.783Z",
      "x_nadsec_last_seen": "2026-05-19T06:03:26.783Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--19220024-6538-43b3-9674-67a5bfb48e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.168.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T05:15:51.435Z",
      "x_nadsec_last_seen": "2026-05-19T05:15:52.077Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--2f70e3fe-59a6-492d-92d5-d79d1fe8d042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.0.84.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T05:54:54.421Z",
      "x_nadsec_last_seen": "2026-05-19T05:56:58.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--e09922a5-268f-4608-baf3-c6dfb8edfc97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.204.110.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T05:52:09.709Z",
      "x_nadsec_last_seen": "2026-05-19T05:58:49.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=9924; asn_org=Taiwan Fixed Network, Telco and Network Service Provider.",
      "id": "indicator--2e3816c6-13fb-446e-80b6-250e5c8c279a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.30.133.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T05:47:58.854Z",
      "x_nadsec_last_seen": "2026-05-19T06:48:51.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9924"
      ],
      "x_nadsec_orgs": [
        "Taiwan Fixed Network, Telco and Network Service Provider."
      ]
    },
    {
      "created": "2026-05-19T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c6c70eb8-7c72-4f56-8f9a-a9bb2c488061",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.186.159.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T06:05:11.000Z",
      "valid_until": "2026-06-20T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-19T06:00:51.606Z",
      "x_nadsec_last_seen": "2026-05-19T08:29:04.760Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b872f62d-8f2c-4fb8-b682-631b3ea257df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.168.96.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T06:44:33.970Z",
      "x_nadsec_last_seen": "2026-05-19T06:51:01.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=149023; asn_org=Ultra Quick SMC-Private Limited",
      "id": "indicator--52cf4b28-3fcf-4a55-b958-c2ee13c2b000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.246.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T06:10:12.683Z",
      "x_nadsec_last_seen": "2026-05-19T06:17:57.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "149023"
      ],
      "x_nadsec_orgs": [
        "Ultra Quick SMC-Private Limited"
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--f6ec04af-9584-4369-8ede-7f9e23295f9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.175.253.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T06:15:48.378Z",
      "x_nadsec_last_seen": "2026-05-19T06:17:53.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5fbbdf25-38a7-44cb-87fb-25ea9e463a5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T06:10:37.954Z",
      "x_nadsec_last_seen": "2026-05-19T06:10:48.305Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=24122; asn_org=BDCOM Online Limited",
      "id": "indicator--4214d066-82f8-4d29-bde9-599089430bef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.4.66.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T06:41:59.834Z",
      "x_nadsec_last_seen": "2026-05-19T06:44:04.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24122"
      ],
      "x_nadsec_orgs": [
        "BDCOM Online Limited"
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--9b88d662-16fc-4d0f-96f3-cf183a8eda21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.205.15.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T06:09:19.721Z",
      "x_nadsec_last_seen": "2026-05-29T01:28:54.550Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=274063; asn_org=RIMTEL S.A.S.",
      "id": "indicator--c82200da-d2cc-4ff5-95ee-7ac027230202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.190.87.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T06:26:04.660Z",
      "x_nadsec_last_seen": "2026-05-19T06:28:11.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "274063"
      ],
      "x_nadsec_orgs": [
        "RIMTEL S.A.S."
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--984236bb-51b4-426d-aad9-fc719bf60f33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.144.16.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T06:24:34.192Z",
      "x_nadsec_last_seen": "2026-05-19T06:30:56.871Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b5915a1c-c68e-4185-a4dd-da36f9eb6357",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.68.194.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T07:05:02.000Z",
      "valid_until": "2026-06-20T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T06:29:34.818Z",
      "x_nadsec_last_seen": "2026-05-19T06:30:48.763Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=9381; asn_org=HKBN Enterprise Solutions HK Limited",
      "id": "indicator--9767bcf2-73c3-4c30-b83b-14a93963765d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.6.51.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:35:51.941Z",
      "x_nadsec_last_seen": "2026-05-19T07:37:56.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9381"
      ],
      "x_nadsec_orgs": [
        "HKBN Enterprise Solutions HK Limited"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7f2e828e-548f-4b5d-82d6-33e7d5cb0327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.180.34.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:06:43.925Z",
      "x_nadsec_last_seen": "2026-05-19T07:08:48.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--76ff9b75-13f5-4c09-a69b-0948b447902f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.90.140.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T07:55:27.860Z",
      "x_nadsec_last_seen": "2026-05-19T07:55:31.194Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--fdd8bf8b-c510-4668-bd83-85cf078fdf0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.88.158.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-19T07:26:59.413Z",
      "x_nadsec_last_seen": "2026-05-24T19:53:49.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--342fa0ca-083d-402f-9025-d8be1286af97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.185.223.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T07:58:21.418Z",
      "x_nadsec_last_seen": "2026-05-19T07:59:43.970Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--6fab4d11-8fce-403b-9828-74cab2402d5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.158.197.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T07:09:22.644Z",
      "x_nadsec_last_seen": "2026-05-19T07:09:22.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--7a8c6857-0a66-4641-a6ee-d25a2248cb07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.76.1.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:10:43.194Z",
      "x_nadsec_last_seen": "2026-05-19T07:12:48.121Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--1ee3cdd3-e977-4fe6-8a3f-206274a69eda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.6.47.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:43:03.091Z",
      "x_nadsec_last_seen": "2026-05-19T07:45:08.799Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--84f59d9e-8fd7-47ab-8470-2c58b7a56972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.159.202.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:11:28.157Z",
      "x_nadsec_last_seen": "2026-05-19T07:13:33.964Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--cb686c97-8f75-4632-9163-5e89148c8df4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.223.191.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-19T07:31:37.985Z",
      "x_nadsec_last_seen": "2026-05-19T08:14:18.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134863; asn_org=SP INTERNET TECHNOLOGIES PRIVATE LTD",
      "id": "indicator--d7575b85-70a3-4cd4-ba6d-4557880da44e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.16.91.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:28:55.839Z",
      "x_nadsec_last_seen": "2026-05-19T07:29:00.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134863"
      ],
      "x_nadsec_orgs": [
        "SP INTERNET TECHNOLOGIES PRIVATE LTD"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=48503; asn_org=Mobile Telecom-Service LLP",
      "id": "indicator--697cf405-1fb3-4cea-b3c4-8b7d7f2fdd1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.96.69.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:21:43.003Z",
      "x_nadsec_last_seen": "2026-05-19T07:23:50.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "48503"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecom-Service LLP"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--0f871724-9e48-4a26-9597-a82a47d17e99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.64.160.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:49:29.102Z",
      "x_nadsec_last_seen": "2026-05-19T07:51:33.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--60af568f-e51c-4723-b3e2-4cccb5e6c624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.129.148.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:22:22.012Z",
      "x_nadsec_last_seen": "2026-05-19T07:24:27.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=136384; asn_org=Optix Pakistan Pvt. Limited",
      "id": "indicator--c1e09898-a73a-44db-8647-ed4551e09cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.251.255.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:20:12.985Z",
      "x_nadsec_last_seen": "2026-05-19T07:22:18.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "136384"
      ],
      "x_nadsec_orgs": [
        "Optix Pakistan Pvt. Limited"
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=38972; asn_org=Suhoy Log Intersat Ltd.",
      "id": "indicator--b8268bfc-5c98-4fb1-a71d-e37f200a7592",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.254.24.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T07:21:21.167Z",
      "x_nadsec_last_seen": "2026-05-19T07:23:26.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "38972"
      ],
      "x_nadsec_orgs": [
        "Suhoy Log Intersat Ltd."
      ]
    },
    {
      "created": "2026-05-19T08:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--cd7d4bcb-b7c7-450d-ba2f-a362f233186e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T08:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.181.73.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T08:05:29.000Z",
      "valid_until": "2026-06-20T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T07:55:33.750Z",
      "x_nadsec_last_seen": "2026-05-19T07:57:38.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--9abb2655-8bd3-4098-8b58-6d623fefc393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.144.175.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:05:10.000Z",
      "valid_until": "2026-06-20T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T09:02:44.221Z",
      "x_nadsec_last_seen": "2026-05-19T09:04:48.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8ebb6dcc-454e-4f80-ae91-5300b754e4c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.116.160.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:05:10.000Z",
      "valid_until": "2026-06-20T09:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T08:23:42.066Z",
      "x_nadsec_last_seen": "2026-05-19T08:41:08.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269771; asn_org=PRINTER-NET-SERVICE, C.A.",
      "id": "indicator--fdb51c51-6884-4945-a242-a80b680cac89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.62.127.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:05:10.000Z",
      "valid_until": "2026-06-20T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T08:47:17.899Z",
      "x_nadsec_last_seen": "2026-05-19T08:47:24.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269771"
      ],
      "x_nadsec_orgs": [
        "PRINTER-NET-SERVICE, C.A."
      ]
    },
    {
      "created": "2026-05-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--dc6bae7f-e2fc-4218-a40c-3494decdb990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:05:10.000Z",
      "valid_until": "2026-06-20T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T08:37:47.695Z",
      "x_nadsec_last_seen": "2026-05-19T08:38:17.693Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--269bb4f3-0b13-4c1c-90fb-7a0df7a2579f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.185.233.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:05:10.000Z",
      "valid_until": "2026-06-20T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T08:43:09.727Z",
      "x_nadsec_last_seen": "2026-05-19T08:45:16.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e12c2c48-a1ce-43f2-a5bd-ee4cd0fc6cef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.185.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:05:10.000Z",
      "valid_until": "2026-06-20T09:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T08:55:26.034Z",
      "x_nadsec_last_seen": "2026-05-19T08:55:26.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=29456; asn_org=Rostelecom",
      "id": "indicator--eaa37b92-9680-47be-b0d4-7ab7d1aea101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.151.126.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T09:05:10.000Z",
      "valid_until": "2026-06-20T09:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T08:22:35.193Z",
      "x_nadsec_last_seen": "2026-05-19T08:23:51.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29456"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=150980; asn_org=PT Menara Digital Salama",
      "id": "indicator--a04115ca-5e79-42b2-bea8-eab56ab0a797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.70.122.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T09:19:00.150Z",
      "x_nadsec_last_seen": "2026-05-19T09:25:36.630Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "150980"
      ],
      "x_nadsec_orgs": [
        "PT Menara Digital Salama"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=272066; asn_org=FIBRAZUL INTERNET S.R.L.",
      "id": "indicator--24b230ad-6ad2-4817-9f22-a160ec022807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.107.242.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T09:49:08.547Z",
      "x_nadsec_last_seen": "2026-05-19T09:51:14.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "272066"
      ],
      "x_nadsec_orgs": [
        "FIBRAZUL INTERNET S.R.L."
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--c7f8f65e-1a29-4756-8021-cca732d55274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T09:57:27.119Z",
      "x_nadsec_last_seen": "2026-05-19T09:57:27.119Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GE; asn=201174; asn_org=Tbilisi City Hall",
      "id": "indicator--535df6a5-1637-4e81-adf8-6ba51a385d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.83.37.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T10:02:22.529Z",
      "x_nadsec_last_seen": "2026-05-19T10:03:26.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "201174"
      ],
      "x_nadsec_orgs": [
        "Tbilisi City Hall"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--66704f55-6eee-494b-91e4-8b2991abcb91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T09:37:47.538Z",
      "x_nadsec_last_seen": "2026-05-19T09:38:19.975Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--152d7a9c-cb93-4040-b345-82fb231a1f73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.74.10.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T09:28:53.775Z",
      "x_nadsec_last_seen": "2026-05-19T09:30:58.747Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16276; asn_org=OVH SAS",
      "id": "indicator--51de1ec3-de77-4542-a164-84a1fa87217e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.160.67.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T09:35:32.682Z",
      "x_nadsec_last_seen": "2026-05-19T09:35:32.682Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SG; asn=4907; asn_org=BGPNET PTE. LTD.",
      "id": "indicator--7c2554a2-4d5a-4a9b-bc76-fd1ce4f0d0bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.248.173.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T09:42:01.058Z",
      "x_nadsec_last_seen": "2026-05-19T09:44:05.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "4907"
      ],
      "x_nadsec_orgs": [
        "BGPNET PTE. LTD."
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T09:35:10.925Z",
      "x_nadsec_last_seen": "2026-05-19T09:35:10.925Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=21017; asn_org=Rostelecom",
      "id": "indicator--506cb56b-5b09-4711-bce2-898f73226007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.83.209.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T09:45:48.657Z",
      "x_nadsec_last_seen": "2026-05-19T09:45:48.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21017"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T10:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=21499; asn_org=Host Europe GmbH",
      "id": "indicator--f53a6405-ced6-443a-9ba5-214248251524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T10:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.205.176.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T10:05:05.000Z",
      "valid_until": "2026-06-20T10:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T10:01:32.637Z",
      "x_nadsec_last_seen": "2026-05-19T10:01:32.637Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "21499"
      ],
      "x_nadsec_orgs": [
        "Host Europe GmbH"
      ]
    },
    {
      "created": "2026-05-19T11:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=132774; asn_org=Niss Internet services private limited",
      "id": "indicator--55bd5cc7-66d9-4b69-a0bc-ed2b1e422a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.26.111.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:05:35.000Z",
      "valid_until": "2026-06-20T11:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T10:14:09.077Z",
      "x_nadsec_last_seen": "2026-05-19T10:14:09.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132774"
      ],
      "x_nadsec_orgs": [
        "Niss Internet services private limited"
      ]
    },
    {
      "created": "2026-05-19T11:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=132774; asn_org=Niss Internet services private limited",
      "id": "indicator--297fbdd8-1e59-4d9f-8f4b-9b815aaf986f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.26.111.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:05:35.000Z",
      "valid_until": "2026-06-20T11:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T10:12:03.976Z",
      "x_nadsec_last_seen": "2026-05-19T10:14:08.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132774"
      ],
      "x_nadsec_orgs": [
        "Niss Internet services private limited"
      ]
    },
    {
      "created": "2026-05-19T11:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47626; asn_org=Timer, LLC",
      "id": "indicator--e18685c2-5e37-4424-afee-d0db54f06e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.118.244.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:05:35.000Z",
      "valid_until": "2026-06-20T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T10:07:32.221Z",
      "x_nadsec_last_seen": "2026-05-19T10:13:05.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47626"
      ],
      "x_nadsec_orgs": [
        "Timer, LLC"
      ]
    },
    {
      "created": "2026-05-19T11:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f5e725ea-53d8-45dd-b91a-11abef408693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.78.125.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:05:35.000Z",
      "valid_until": "2026-06-20T11:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T11:02:59.192Z",
      "x_nadsec_last_seen": "2026-05-19T11:05:04.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T11:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--20d6f92c-81c2-4118-a669-33aefac51ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.84.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:05:35.000Z",
      "valid_until": "2026-06-20T11:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T10:44:23.862Z",
      "x_nadsec_last_seen": "2026-05-19T10:44:47.527Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-19T11:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--c1ee61ab-158b-4fc0-b5a7-4cac825e903d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:05:35.000Z",
      "valid_until": "2026-06-20T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T10:33:14.019Z",
      "x_nadsec_last_seen": "2026-05-20T20:19:17.225Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-19T11:05:35.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=BG; asn=211486; asn_org=Alferov Aleksey Aleksandrovich",
      "id": "indicator--3acd1408-2d7b-4ea7-bf5e-e73c66cfd0d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T11:05:35.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.152.208.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:05:35.000Z",
      "valid_until": "2026-06-20T11:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T10:15:29.410Z",
      "x_nadsec_last_seen": "2026-05-19T10:15:39.848Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "211486"
      ],
      "x_nadsec_orgs": [
        "Alferov Aleksey Aleksandrovich"
      ]
    },
    {
      "created": "2026-05-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--ca229e4a-e198-44ff-bc6e-1ebb73cbe22d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.34.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:05:02.000Z",
      "valid_until": "2026-06-20T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T11:18:35.539Z",
      "x_nadsec_last_seen": "2026-05-19T11:26:44.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--c294e6f1-2fca-456e-a033-7abd1afe37ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.21.217.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:05:02.000Z",
      "valid_until": "2026-06-20T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T11:57:49.965Z",
      "x_nadsec_last_seen": "2026-05-19T12:04:03.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--ce1d315f-46d6-450c-8003-cc7eb927ee61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.204.227.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:05:02.000Z",
      "valid_until": "2026-06-20T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T11:44:08.712Z",
      "x_nadsec_last_seen": "2026-05-19T11:46:13.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=61; services=mysqld; ports=3306; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4041d8c6-2e90-4bc2-9adc-cee2bdd71cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.64.227.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:05:02.000Z",
      "valid_until": "2026-06-20T12:05:00.000Z",
      "x_nadsec_event_count": 61,
      "x_nadsec_first_seen": "2026-05-19T11:53:34.137Z",
      "x_nadsec_last_seen": "2026-05-19T11:58:29.243Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n",
        "a*******v"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--e97147ab-04c3-4dc0-b5f0-0a62b751b1a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.206.237.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:05:02.000Z",
      "valid_until": "2026-06-20T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T11:23:09.786Z",
      "x_nadsec_last_seen": "2026-05-19T11:23:15.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--2e82490f-bed9-441f-b19d-9af52ed49ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.237.53.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:05:02.000Z",
      "valid_until": "2026-06-20T12:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T11:26:23.184Z",
      "x_nadsec_last_seen": "2026-05-19T11:26:23.184Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48524; asn_org=INTERRA telecommunications group, Ltd.",
      "id": "indicator--4cf13900-0671-4810-a768-9392e63539df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.190.56.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T12:05:02.000Z",
      "valid_until": "2026-06-20T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T11:51:56.508Z",
      "x_nadsec_last_seen": "2026-05-19T11:52:03.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48524"
      ],
      "x_nadsec_orgs": [
        "INTERRA telecommunications group, Ltd."
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TH; asn=23969; asn_org=TOT Public Company Limited; user(top)=**",
      "id": "indicator--0fff9bcb-9acd-4597-ade8-acc7b408420b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.108.104.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T12:57:47.272Z",
      "x_nadsec_last_seen": "2026-05-19T12:57:47.272Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=CN; asn=4847; asn_org=China Networks Inter-Exchange; user(top)=**",
      "id": "indicator--e46ff6eb-f186-4679-9b80-016d998931fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.182.75.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T12:56:18.973Z",
      "x_nadsec_last_seen": "2026-05-19T12:56:44.622Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4847"
      ],
      "x_nadsec_orgs": [
        "China Networks Inter-Exchange"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9016a757-4861-42eb-872a-22b26187c546",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.163.65.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T13:00:05.665Z",
      "x_nadsec_last_seen": "2026-05-19T13:02:10.902Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--84579cdd-392f-4b32-821f-a1d6f878d992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.115.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T12:19:44.095Z",
      "x_nadsec_last_seen": "2026-05-19T12:19:44.095Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b434fde6-7c37-4fed-977c-456a132739ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.140.29.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T12:18:12.714Z",
      "x_nadsec_last_seen": "2026-05-19T12:24:42.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--f7aca1ad-2ea2-4634-a612-4677a693bade",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.131.121.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T12:54:31.071Z",
      "x_nadsec_last_seen": "2026-05-19T13:01:28.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--8845a62b-2e84-4205-ab30-2a3c91bd32d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.34.92.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T12:58:39.492Z",
      "x_nadsec_last_seen": "2026-05-19T13:00:46.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--39ca5f18-78d1-43b3-a817-6dfe1b382ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T12:59:47.972Z",
      "x_nadsec_last_seen": "2026-05-19T12:59:47.972Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--55e1f11a-d3b7-480e-9500-b029ddd21a69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T12:59:48.780Z",
      "x_nadsec_last_seen": "2026-05-19T12:59:48.780Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--4a9323e5-6084-444c-923a-2d911f55d826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T12:59:48.240Z",
      "x_nadsec_last_seen": "2026-05-19T12:59:48.240Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=27; services=httpd; ports=81; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 336,
      "x_nadsec_first_seen": "2026-05-19T12:39:44.378Z",
      "x_nadsec_last_seen": "2026-05-31T08:22:53.168Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1433",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "smbd",
        "mssqld",
        "pptpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17878; asn_org=DREAMMARK1",
      "id": "indicator--a61a5b9b-7035-48f0-b2f2-afd262f2a476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.238.249.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T12:44:52.289Z",
      "x_nadsec_last_seen": "2026-05-19T12:46:56.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17878"
      ],
      "x_nadsec_orgs": [
        "DREAMMARK1"
      ]
    },
    {
      "created": "2026-05-19T13:05:48.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=AE; asn=26832; asn_org=Rica Web Services",
      "id": "indicator--e60822d0-71d1-4363-b3be-f612c9b094e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T13:05:48.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.107.168.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:05:48.000Z",
      "valid_until": "2026-06-20T13:05:08.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-05-19T12:45:07.189Z",
      "x_nadsec_last_seen": "2026-05-22T00:05:34.868Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "26832"
      ],
      "x_nadsec_orgs": [
        "Rica Web Services"
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=135353; asn_org=MD SHIRAJUL HAIDER TA Cue Club Technology; user(top)=**",
      "id": "indicator--4c1378f5-e430-494b-b40a-86e0e9e5463a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.214.219.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T13:29:20.593Z",
      "x_nadsec_last_seen": "2026-05-19T13:29:20.593Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "135353"
      ],
      "x_nadsec_orgs": [
        "MD SHIRAJUL HAIDER TA Cue Club Technology"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--72f675be-9a32-403c-a041-0ba402218dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.152.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T14:00:42.080Z",
      "x_nadsec_last_seen": "2026-05-19T14:02:48.817Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52898; asn_org=Multipla Servicos Inteligentes",
      "id": "indicator--08387e65-660b-4ff1-9c57-0afe7098683e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.184.78.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T13:30:47.937Z",
      "x_nadsec_last_seen": "2026-05-19T13:32:55.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52898"
      ],
      "x_nadsec_orgs": [
        "Multipla Servicos Inteligentes"
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PY; asn=23201; asn_org=Telecel S.A.",
      "id": "indicator--5245059b-d5d4-4168-96fb-53c225f79785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.40.108.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-19T13:38:53.712Z",
      "x_nadsec_last_seen": "2026-05-27T20:30:12.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "23201"
      ],
      "x_nadsec_orgs": [
        "Telecel S.A."
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--7f223ec4-017d-4457-864b-16217dcc431f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.198.114.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T13:22:47.518Z",
      "x_nadsec_last_seen": "2026-05-19T13:22:47.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b893af61-73ff-4657-b74d-c8205a2d167e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.241.166.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T14:03:29.440Z",
      "x_nadsec_last_seen": "2026-05-26T06:29:00.074Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TN; asn=37705; asn_org=TOPNET; user(top)=**",
      "id": "indicator--b2db9170-7c88-47f5-8328-58d210df1c43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.62.141.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T13:51:15.090Z",
      "x_nadsec_last_seen": "2026-05-19T13:51:15.090Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--ee847134-5153-4437-b161-f63adbacf6bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.188.225.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:05:10.000Z",
      "valid_until": "2026-06-20T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T14:00:24.072Z",
      "x_nadsec_last_seen": "2026-05-19T14:05:37.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-19T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=SK; asn=6830; asn_org=Liberty Global Europe Holding B.V.",
      "id": "indicator--dbb096e5-9b76-4178-9f5b-62f3aac856a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.167.251.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:05:10.000Z",
      "valid_until": "2026-06-20T15:05:09.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-05-19T14:47:18.956Z",
      "x_nadsec_last_seen": "2026-05-19T14:51:33.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SK"
      ],
      "x_nadsec_asns": [
        "6830"
      ],
      "x_nadsec_orgs": [
        "Liberty Global Europe Holding B.V."
      ]
    },
    {
      "created": "2026-05-19T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=270706; asn_org=LAN TELECOM INTERNET BANDA LARGA LTDA",
      "id": "indicator--81a787c4-4e15-4a67-85ba-33f8c077cdb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.127.155.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:05:10.000Z",
      "valid_until": "2026-06-20T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T14:11:51.568Z",
      "x_nadsec_last_seen": "2026-05-19T14:13:58.759Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "270706"
      ],
      "x_nadsec_orgs": [
        "LAN TELECOM INTERNET BANDA LARGA LTDA"
      ]
    },
    {
      "created": "2026-05-19T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--52f578f1-2f12-4845-8118-523d3c95bcfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.33.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:05:10.000Z",
      "valid_until": "2026-06-20T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T15:04:37.060Z",
      "x_nadsec_last_seen": "2026-05-30T17:15:36.874Z",
      "x_nadsec_ports": [
        "27017",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--18632071-d389-44bd-a134-bc05f298dd59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:05:10.000Z",
      "valid_until": "2026-06-20T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T14:06:49.963Z",
      "x_nadsec_last_seen": "2026-05-19T14:06:50.299Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=24432; asn_org=TM International Bangladesh",
      "id": "indicator--3349a6c1-72a6-4a23-9afe-726ea5be6da3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.134.12.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:05:10.000Z",
      "valid_until": "2026-06-20T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T14:54:08.783Z",
      "x_nadsec_last_seen": "2026-05-19T14:56:13.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24432"
      ],
      "x_nadsec_orgs": [
        "TM International Bangladesh"
      ]
    },
    {
      "created": "2026-05-19T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=20978; asn_org=TT Mobil Iletisim Hizmetleri A.S",
      "id": "indicator--d04dbb53-4cdb-4dcc-b138-6fd0d20f990f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.176.11.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:05:10.000Z",
      "valid_until": "2026-06-20T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T14:12:45.493Z",
      "x_nadsec_last_seen": "2026-05-19T14:14:52.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "20978"
      ],
      "x_nadsec_orgs": [
        "TT Mobil Iletisim Hizmetleri A.S"
      ]
    },
    {
      "created": "2026-05-19T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:05:10.000Z",
      "valid_until": "2026-06-20T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T14:45:46.330Z",
      "x_nadsec_last_seen": "2026-05-19T14:45:46.330Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--464a375b-5556-46cd-ab61-fa0604d4556f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.251.159.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T15:13:33.786Z",
      "x_nadsec_last_seen": "2026-05-19T15:15:38.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=203971; asn_org=AzFiberNet LLC",
      "id": "indicator--53410b0d-639b-42ef-955f-c56a357498d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.222.94.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T15:49:47.023Z",
      "x_nadsec_last_seen": "2026-05-25T15:31:53.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "203971"
      ],
      "x_nadsec_orgs": [
        "AzFiberNet LLC"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=31245; asn_org=ATI-ISP",
      "id": "indicator--7c161f1c-f255-4c27-82bd-e9cbaceaa291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.95.2.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T15:22:57.476Z",
      "x_nadsec_last_seen": "2026-05-27T22:01:33.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "31245"
      ],
      "x_nadsec_orgs": [
        "ATI-ISP"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4257b59b-4479-4ee8-bfeb-74261bfd2e9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T15:45:19.764Z",
      "x_nadsec_last_seen": "2026-05-19T15:45:30.082Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--5d2bdef6-2e62-4183-b734-f5ddd08b0482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T15:21:30.809Z",
      "x_nadsec_last_seen": "2026-05-19T15:22:23.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ddb7a8bd-49d0-4cc2-b50e-3708013c3a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.88.186.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T15:55:58.184Z",
      "x_nadsec_last_seen": "2026-05-19T15:58:03.660Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KW; asn=42961; asn_org=Mobile Telecommunications Company K.S.C.P.",
      "id": "indicator--8d7f7203-ab2e-4612-9154-650365a5cb74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.34.180.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-19T15:12:58.553Z",
      "x_nadsec_last_seen": "2026-05-30T21:34:42.946Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "42961"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecommunications Company K.S.C.P."
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3339c298-48d6-43f1-8ef6-24b12bea9b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T15:33:26.769Z",
      "x_nadsec_last_seen": "2026-05-30T00:32:46.393Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--52856dd8-6ac0-408c-a399-1837f2d3ce17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.10.14.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 3199,
      "x_nadsec_first_seen": "2026-05-19T15:48:02.360Z",
      "x_nadsec_last_seen": "2026-05-30T22:16:09.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--b7acd9e4-906f-45aa-a4b4-d49690b4fd5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T15:05:13.526Z",
      "x_nadsec_last_seen": "2026-05-19T15:05:13.526Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ad6d4167-6223-421d-b6bd-16f91c58d764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T15:53:34.920Z",
      "x_nadsec_last_seen": "2026-05-19T15:53:34.920Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-19T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2858c35b-9a80-4cc4-90ad-4bdedfc9b902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:05:10.000Z",
      "valid_until": "2026-06-20T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T15:53:35.126Z",
      "x_nadsec_last_seen": "2026-05-27T14:43:43.726Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-19T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--253dcd37-7df7-4acc-b1f6-92e51737ce05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.53.54.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:05:11.000Z",
      "valid_until": "2026-06-20T17:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T16:21:34.339Z",
      "x_nadsec_last_seen": "2026-05-22T09:56:06.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-05-19T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--6aaee504-0f47-48bf-b272-ffc1a79b5444",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.131.186.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:05:11.000Z",
      "valid_until": "2026-06-20T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T16:17:38.094Z",
      "x_nadsec_last_seen": "2026-05-19T16:17:38.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-19T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--7e2be634-ae49-4fe2-b3e3-fdcceed64746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.77.109.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:05:11.000Z",
      "valid_until": "2026-06-20T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T16:21:55.671Z",
      "x_nadsec_last_seen": "2026-05-19T16:21:55.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-19T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--dd361783-959a-4618-9b54-98871cbb828a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.6.65.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:05:11.000Z",
      "valid_until": "2026-06-20T17:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T17:02:05.481Z",
      "x_nadsec_last_seen": "2026-05-19T18:29:53.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-19T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--422f362e-0453-4e06-a221-cae60f8b74bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.207.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:05:11.000Z",
      "valid_until": "2026-06-20T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T16:19:53.638Z",
      "x_nadsec_last_seen": "2026-05-19T16:20:17.189Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-19T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--076dd469-1a83-47c5-a099-e56c3a4f5f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:05:11.000Z",
      "valid_until": "2026-06-20T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T16:35:05.069Z",
      "x_nadsec_last_seen": "2026-05-19T16:35:05.069Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-19T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--3c2718b6-9e72-4e13-8b3d-e9b4b5736b6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.232.91.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:05:11.000Z",
      "valid_until": "2026-06-20T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T16:08:26.797Z",
      "x_nadsec_last_seen": "2026-05-19T16:10:34.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--8961816c-573a-4952-8839-4d1be4420b0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.251.86.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T17:17:40.097Z",
      "x_nadsec_last_seen": "2026-05-19T18:24:52.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b18e5318-c324-49cc-975f-f34074953814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.14.17.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T17:36:14.385Z",
      "x_nadsec_last_seen": "2026-05-23T12:44:04.590Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=52551; asn_org=SAMM Sociedade de Atividades em Multimidia LTDA",
      "id": "indicator--a418725f-9b24-4448-abcd-49b7fde7040f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.130.117.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T17:27:40.018Z",
      "x_nadsec_last_seen": "2026-05-19T17:29:44.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52551"
      ],
      "x_nadsec_orgs": [
        "SAMM Sociedade de Atividades em Multimidia LTDA"
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--719a76f2-d512-4bfb-b095-cca9e883e58d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.74.4.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T17:38:38.554Z",
      "x_nadsec_last_seen": "2026-05-27T12:04:32.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31261; asn_org=PJSC MegaFon",
      "id": "indicator--1c5cea85-14de-48c0-a1d7-47b51bc53a5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.68.146.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T17:37:41.953Z",
      "x_nadsec_last_seen": "2026-05-19T17:43:00.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31261"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--21681e72-7937-4648-bbcc-07ecf66c8747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.122.233.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T17:07:55.017Z",
      "x_nadsec_last_seen": "2026-05-19T17:07:55.017Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=131429; asn_org=MOBIFONE Corporation",
      "id": "indicator--4122cf66-902e-4baf-8159-64f0860c875a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.153.243.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T17:05:49.675Z",
      "x_nadsec_last_seen": "2026-05-19T17:07:54.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "131429"
      ],
      "x_nadsec_orgs": [
        "MOBIFONE Corporation"
      ]
    },
    {
      "created": "2026-05-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--a95f8b16-4e11-4ddc-99cd-bdda28a1ab8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.104.85.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T18:05:10.000Z",
      "valid_until": "2026-06-20T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T17:53:43.368Z",
      "x_nadsec_last_seen": "2026-05-19T17:55:50.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--1224d117-601d-4b0c-97d2-4d2ead0adabc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.101.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T18:43:15.958Z",
      "x_nadsec_last_seen": "2026-05-19T18:45:24.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--1708ccdd-f13b-41f7-aa1b-03989a1981f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.93.8.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T18:46:40.746Z",
      "x_nadsec_last_seen": "2026-05-19T18:48:48.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5b3a44a7-c8e3-4c06-81f8-eabb75944d8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.228.100.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T18:42:11.971Z",
      "x_nadsec_last_seen": "2026-05-19T18:44:34.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--1f8119b9-9811-42a7-a501-bcffd19bc1bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.97.77.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T18:47:07.544Z",
      "x_nadsec_last_seen": "2026-05-19T18:47:48.083Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a9e35e89-e76d-4a29-8cae-b86bd52c0865",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-10T17:23:50.574Z",
      "x_nadsec_last_seen": "2026-05-19T18:13:32.658Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b36f21a6-f0da-4572-b8fa-e00fb2c6bb34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.12.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T18:55:24.520Z",
      "x_nadsec_last_seen": "2026-05-19T18:55:44.253Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--bb6612fa-6213-415d-9201-380933e22b32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.134.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T18:24:58.060Z",
      "x_nadsec_last_seen": "2026-05-19T18:25:21.599Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50477; asn_org=Svyaz-Energo Ltd.",
      "id": "indicator--d7d85f74-d3f7-4904-85d8-dbdf4368f55d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.149.203.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T18:48:33.180Z",
      "x_nadsec_last_seen": "2026-05-19T18:49:51.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50477"
      ],
      "x_nadsec_orgs": [
        "Svyaz-Energo Ltd."
      ]
    },
    {
      "created": "2026-05-19T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--405e8435-d142-44e9-b42b-a2b0b4f1f14e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:05:10.000Z",
      "valid_until": "2026-06-20T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T18:28:36.054Z",
      "x_nadsec_last_seen": "2026-05-27T08:36:08.306Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2f6e1115-df8e-4d55-81e7-6c1b1e636f42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.46.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-19T19:19:10.230Z",
      "x_nadsec_last_seen": "2026-05-19T19:19:28.038Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--3d2336bf-c23b-4594-b2a8-dd74be37f806",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.172.108.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T19:08:06.349Z",
      "x_nadsec_last_seen": "2026-05-29T18:22:40.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--830812b6-887c-4508-82c7-d488f8690a3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.108.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T19:13:57.153Z",
      "x_nadsec_last_seen": "2026-05-19T19:13:57.153Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=264659; asn_org=Sol Cablevision S.A.S E.S.P",
      "id": "indicator--25826a0f-ec04-4e67-a2d5-bd3e60c2f2fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.43.109.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T19:18:40.053Z",
      "x_nadsec_last_seen": "2026-05-19T19:20:46.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "264659"
      ],
      "x_nadsec_orgs": [
        "Sol Cablevision S.A.S E.S.P"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--5f12cae7-b86f-41fc-828c-7e1d042c524f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.112.146.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T19:56:54.401Z",
      "x_nadsec_last_seen": "2026-05-19T19:59:01.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--fc0fb92e-4b63-4211-b5c6-7a5825e7b571",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.77.76.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T19:46:42.568Z",
      "x_nadsec_last_seen": "2026-05-19T19:48:48.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b763394a-d26b-414f-912e-0ae9dde41455",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.229.117.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T19:31:26.570Z",
      "x_nadsec_last_seen": "2026-05-19T19:33:31.534Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=19318; asn_org=Interserver, Inc",
      "id": "indicator--9af5939a-d6f5-4cfb-8ff6-e60a1ebed274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '69.169.102.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-19T19:16:27.755Z",
      "x_nadsec_last_seen": "2026-05-19T19:16:28.001Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "19318"
      ],
      "x_nadsec_orgs": [
        "Interserver, Inc"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "w**k"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--4425e12f-c6a2-4f20-aa42-327dcda5c9ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.72.181.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T19:24:54.607Z",
      "x_nadsec_last_seen": "2026-05-19T19:27:02.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BH; asn=35568; asn_org=Nuetel Communications B.S.C",
      "id": "indicator--d0f4c3f0-382d-43f7-be8f-793af4dd5e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.142.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T19:47:28.285Z",
      "x_nadsec_last_seen": "2026-05-19T19:49:35.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BH"
      ],
      "x_nadsec_asns": [
        "35568"
      ],
      "x_nadsec_orgs": [
        "Nuetel Communications B.S.C"
      ]
    },
    {
      "created": "2026-05-19T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=29894; asn_org=South Central Rural Telecommunications Cooperative Inc.",
      "id": "indicator--419b9682-52ac-4ef2-9f98-d3a6b565e17e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '96.31.62.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:05:10.000Z",
      "valid_until": "2026-06-20T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T20:03:56.722Z",
      "x_nadsec_last_seen": "2026-05-19T20:10:41.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "29894"
      ],
      "x_nadsec_orgs": [
        "South Central Rural Telecommunications Cooperative Inc."
      ]
    },
    {
      "created": "2026-05-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--4140a4b0-56f9-4ed0-abb0-64f1c020fcef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.210.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:05:03.000Z",
      "valid_until": "2026-06-20T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T20:58:07.175Z",
      "x_nadsec_last_seen": "2026-05-19T21:00:14.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--12f0cd0b-fea0-47b3-b562-ecd6a22a9543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.81.47.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:05:03.000Z",
      "valid_until": "2026-06-20T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T20:34:04.658Z",
      "x_nadsec_last_seen": "2026-05-19T20:34:04.658Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--3780f74f-76fc-4f72-95c2-3de4a4fa6b0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.173.55.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T21:05:03.000Z",
      "valid_until": "2026-06-20T21:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-19T20:42:37.839Z",
      "x_nadsec_last_seen": "2026-05-19T21:12:52.713Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17465; asn_org=Cable ISP in India",
      "id": "indicator--534432eb-cfc0-44fb-96f8-39ccc57942e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.92.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T21:39:28.628Z",
      "x_nadsec_last_seen": "2026-05-19T21:41:33.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17465"
      ],
      "x_nadsec_orgs": [
        "Cable ISP in India"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--6e950e2f-7a34-445d-a22e-3fa4b93f429c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.133.204.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-19T21:10:36.759Z",
      "x_nadsec_last_seen": "2026-05-26T16:04:23.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--2c1b9620-0dec-43aa-85b4-231b2331cc78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.26.82.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T21:49:09.486Z",
      "x_nadsec_last_seen": "2026-05-19T23:35:02.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--91129173-09d5-4f7b-88c4-72716ba8fa1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.97.18.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T21:42:08.310Z",
      "x_nadsec_last_seen": "2026-05-19T21:48:54.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--952df40d-ed3e-4feb-ae06-503ce76a0063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.19.214.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T21:54:04.121Z",
      "x_nadsec_last_seen": "2026-05-19T21:54:04.121Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3dee4c8a-ce67-4dbd-8b2a-fc24eae991c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.208.46.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T21:13:46.988Z",
      "x_nadsec_last_seen": "2026-05-19T21:21:10.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--51716bbb-ded1-4557-a996-ef6682a5bbfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.44.153.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T21:08:47.500Z",
      "x_nadsec_last_seen": "2026-05-19T21:10:54.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52876; asn_org=PW NETWORK INFORMATICA E TELECOMUNICACOES LTDA",
      "id": "indicator--509e485f-7aa2-411a-84d7-a428bff4baa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.129.183.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T21:47:29.454Z",
      "x_nadsec_last_seen": "2026-05-19T21:49:35.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52876"
      ],
      "x_nadsec_orgs": [
        "PW NETWORK INFORMATICA E TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--f9f1d73f-10cc-4ae1-934b-7604bfc3d304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.134.65.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T21:22:54.286Z",
      "x_nadsec_last_seen": "2026-05-19T21:30:21.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--9bd5e0d0-ef3e-45c0-b7cd-7c15c8eb9dac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.171.37.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T21:28:46.942Z",
      "x_nadsec_last_seen": "2026-05-19T21:30:51.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-05-19T22:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--afac38ff-dfa2-4404-adc9-1f9c103b083e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T22:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.49.56.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:05:16.000Z",
      "valid_until": "2026-06-20T22:05:14.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T21:46:40.053Z",
      "x_nadsec_last_seen": "2026-05-19T21:48:44.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--32d596f1-beb3-49b2-8155-1abf97fdb9a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.65.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T22:28:11.555Z",
      "x_nadsec_last_seen": "2026-05-19T22:28:54.380Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--06282236-a535-4352-99bb-aec956d6e764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.126.108.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T22:37:40.905Z",
      "x_nadsec_last_seen": "2026-05-20T00:07:57.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--1a13c98f-79dd-4f6e-a388-ab0457add13b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.244.23.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T22:36:36.167Z",
      "x_nadsec_last_seen": "2026-05-19T22:43:02.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--11c3ab3b-7d32-4d45-ae63-4cbb5675a4a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T22:15:09.977Z",
      "x_nadsec_last_seen": "2026-05-19T22:15:09.977Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--95d365d5-00b5-4cf4-8bb3-9d526bbef65d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.169.126.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T23:03:00.788Z",
      "x_nadsec_last_seen": "2026-05-19T23:05:07.466Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--06d0e4c8-bddf-4fa7-8e37-c25d7f5ece45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.149.59.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-19T22:11:51.554Z",
      "x_nadsec_last_seen": "2026-05-21T16:16:24.022Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31213; asn_org=PJSC MegaFon",
      "id": "indicator--f9de3444-1105-4bf0-84f9-cf3e6b2a2a46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.170.85.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T22:13:31.385Z",
      "x_nadsec_last_seen": "2026-05-19T22:15:38.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31213"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f5cf5445-4ec3-439d-b0b1-d1eeb0075b99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T22:41:28.267Z",
      "x_nadsec_last_seen": "2026-05-19T22:41:28.267Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--52f63976-b451-4bcd-839a-1e7d0906b69a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T22:41:07.314Z",
      "x_nadsec_last_seen": "2026-05-19T22:41:07.314Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5909aafb-aa84-43b6-9d0a-c82b3acf22c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T22:41:38.669Z",
      "x_nadsec_last_seen": "2026-05-19T22:41:38.669Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--72cf6158-f5bc-4599-a685-116274ca27ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T22:41:07.072Z",
      "x_nadsec_last_seen": "2026-05-19T22:41:07.072Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=14232; asn_org=Cooperativa Telefonica Pinamar Ltda.",
      "id": "indicator--68e8516f-1dc1-4c2a-bc5b-aa3828eb00da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.219.64.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T22:12:44.944Z",
      "x_nadsec_last_seen": "2026-05-19T22:14:51.344Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "14232"
      ],
      "x_nadsec_orgs": [
        "Cooperativa Telefonica Pinamar Ltda."
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f14f07c7-f1cf-4c18-acd4-d051e818f765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T22:30:14.408Z",
      "x_nadsec_last_seen": "2026-05-19T22:30:14.408Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=209896; asn_org=Contrust Solutions S.R.L.",
      "id": "indicator--f8d5a2f1-637c-4278-9039-a9d6df62207f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.91.118.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T22:36:15.679Z",
      "x_nadsec_last_seen": "2026-05-19T22:36:31.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209896"
      ],
      "x_nadsec_orgs": [
        "Contrust Solutions S.R.L."
      ]
    },
    {
      "created": "2026-05-19T23:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HR; asn=35549; asn_org=A1 Hrvatska d.o.o.",
      "id": "indicator--69c7658a-579b-4868-a8b5-e85da30f499d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-19T23:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.134.243.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T23:05:33.000Z",
      "valid_until": "2026-06-20T23:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-19T22:51:40.829Z",
      "x_nadsec_last_seen": "2026-05-19T22:58:38.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HR"
      ],
      "x_nadsec_asns": [
        "35549"
      ],
      "x_nadsec_orgs": [
        "A1 Hrvatska d.o.o."
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=AZ; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.205.211.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 803,
      "x_nadsec_first_seen": "2026-05-19T23:09:05.772Z",
      "x_nadsec_last_seen": "2026-05-26T09:41:36.108Z",
      "x_nadsec_ports": [
        "1433",
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "201814"
      ],
      "x_nadsec_orgs": [
        "MEVSPACE sp. z o.o."
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=45899; asn_org=VNPT Corp; user(top)=**",
      "id": "indicator--256f4ba8-786f-43dc-b140-fe498a6f2c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.229.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T23:06:05.732Z",
      "x_nadsec_last_seen": "2026-05-23T16:49:51.161Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-19T23:13:26.706Z",
      "x_nadsec_last_seen": "2026-05-19T23:13:56.706Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AW; asn=11816; asn_org=SERVICIO DI TELECOMUNICACION DI ARUBA SETAR N.V.",
      "id": "indicator--6037c128-a9ef-4a0c-8045-b28fb57d8612",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.189.59.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-19T23:23:42.853Z",
      "x_nadsec_last_seen": "2026-05-19T23:29:26.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AW"
      ],
      "x_nadsec_asns": [
        "11816"
      ],
      "x_nadsec_orgs": [
        "SERVICIO DI TELECOMUNICACION DI ARUBA SETAR N.V."
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c9dec768-54fe-4627-828d-785930ef029a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T23:35:01.656Z",
      "x_nadsec_last_seen": "2026-05-19T23:35:01.656Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=140293; asn_org=CHINATELECOM Jiangsu province Changzhou 5G network; user(top)=**",
      "id": "indicator--bab3d4a0-aa9e-49e0-a1f2-e59cb7b83709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.93.190.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T23:26:44.746Z",
      "x_nadsec_last_seen": "2026-05-19T23:26:44.746Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "140293"
      ],
      "x_nadsec_orgs": [
        "CHINATELECOM Jiangsu province Changzhou 5G network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--30e194b8-b0bf-45c0-8aff-09fcecaf2328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.77.214.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T23:37:05.667Z",
      "x_nadsec_last_seen": "2026-05-19T23:37:05.667Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-20T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--eb868bbc-2a0b-4643-a97d-90fda4bfcedf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T00:05:11.000Z",
      "valid_until": "2026-06-21T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-19T23:33:48.517Z",
      "x_nadsec_last_seen": "2026-05-19T23:33:48.517Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--d2f24250-6ec7-467b-b499-f1d3e418a705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.144.14.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T00:31:34.440Z",
      "x_nadsec_last_seen": "2026-05-20T00:36:03.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--2fb5a48f-12de-4329-8f01-613a756ed47c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.240.243.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T00:21:02.861Z",
      "x_nadsec_last_seen": "2026-05-20T00:23:07.786Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--09335390-2812-4dc0-beab-245b50730afd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.139.124.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T00:36:04.471Z",
      "x_nadsec_last_seen": "2026-05-20T00:36:04.471Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T00:34:44.903Z",
      "x_nadsec_last_seen": "2026-05-29T22:04:05.761Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB",
      "id": "indicator--099e1c1c-df05-4a9e-8a59-99cdae66e6cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.146.242.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T00:48:43.505Z",
      "x_nadsec_last_seen": "2026-05-20T00:49:27.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--07925285-c5c9-49b0-868e-5d52fb805567",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.249.36.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T00:17:25.543Z",
      "x_nadsec_last_seen": "2026-05-20T00:40:18.248Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--ab54f0e4-4168-4707-9f9a-525cf385e062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.253.188.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T00:06:13.615Z",
      "x_nadsec_last_seen": "2026-05-20T00:08:19.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6423fdcd-4169-4274-a04e-7f9bd57336bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T01:03:56.701Z",
      "x_nadsec_last_seen": "2026-05-20T01:03:56.701Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--bbce3b02-8dc2-4823-9665-05daa7cafbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T00:08:59.300Z",
      "x_nadsec_last_seen": "2026-05-20T00:08:59.300Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--4ec1fbb5-8c38-48b0-a9b5-41a72f59c8d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.136.31.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T00:22:12.051Z",
      "x_nadsec_last_seen": "2026-05-20T00:26:26.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--9014253a-3cee-4c83-bb2a-e4bc6ffeee6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.228.9.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T00:57:55.527Z",
      "x_nadsec_last_seen": "2026-05-20T00:57:55.527Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--51bb20a1-0256-4f24-90ed-80a717616274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.124.20.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T00:47:24.005Z",
      "x_nadsec_last_seen": "2026-05-20T00:49:28.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-20T01:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--01050d42-be1c-4c65-aba6-47099669cb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T01:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.5.65.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:05:19.000Z",
      "valid_until": "2026-06-21T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T00:52:47.550Z",
      "x_nadsec_last_seen": "2026-05-20T00:54:54.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ac233baa-fa52-4b20-adff-a65294cf54f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.250.51.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T01:46:17.948Z",
      "x_nadsec_last_seen": "2026-05-20T01:48:22.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4246e799-9665-4d70-aea5-4624f5e3607c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.164.34.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T01:51:08.048Z",
      "x_nadsec_last_seen": "2026-05-20T01:53:14.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3815fc90-a11d-40fc-b90e-51970b8815dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.77.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T01:15:42.525Z",
      "x_nadsec_last_seen": "2026-05-20T01:15:42.525Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--7fb4cd89-2d5c-4d31-b992-01dce94589a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.251.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-20T01:22:59.170Z",
      "x_nadsec_last_seen": "2026-05-20T01:23:39.172Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d2c28785-b3de-4193-9fbb-4906902b63f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.124.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T01:45:13.926Z",
      "x_nadsec_last_seen": "2026-05-20T01:45:13.926Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--39ce3285-b0df-4089-a266-45867a653a75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.151.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T01:45:00.146Z",
      "x_nadsec_last_seen": "2026-05-20T01:45:12.620Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b3f5e0d1-6bb7-407d-a03d-126cf792a463",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.5.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T01:15:49.539Z",
      "x_nadsec_last_seen": "2026-05-21T10:28:12.494Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--99ebc073-7c0b-4b13-9f08-5d20a2a9314c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.23.121.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T01:27:17.744Z",
      "x_nadsec_last_seen": "2026-05-20T01:27:25.116Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--35462252-23c2-497e-b967-50b4a67793b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.178.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-18T07:52:41.380Z",
      "x_nadsec_last_seen": "2026-05-20T01:12:40.819Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--19984777-ae25-4e70-9d6a-0db02b9cc1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.137.95.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T01:49:57.850Z",
      "x_nadsec_last_seen": "2026-05-20T01:58:25.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9a00837b-8b6c-4f56-9607-ebb3ba4ee6cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.166.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T01:15:44.080Z",
      "x_nadsec_last_seen": "2026-05-20T12:11:45.220Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--dc7a05db-2da9-44ba-867d-74d770f7b5dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T01:13:16.663Z",
      "x_nadsec_last_seen": "2026-05-20T01:13:16.663Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-20T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--811d54c6-4ae2-4db0-9db7-322cad2c1965",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:05:11.000Z",
      "valid_until": "2026-06-21T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T01:49:22.131Z",
      "x_nadsec_last_seen": "2026-05-20T01:49:22.131Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BW; asn=327750; asn_org=JENNY-INTERNET",
      "id": "indicator--d9b11ed8-e922-478f-b8b4-d5152415d1ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.222.51.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-18T14:50:26.123Z",
      "x_nadsec_last_seen": "2026-05-20T02:19:25.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BW"
      ],
      "x_nadsec_asns": [
        "327750"
      ],
      "x_nadsec_orgs": [
        "JENNY-INTERNET"
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--88b8fdd6-65a2-446b-bbb8-4125975ee65d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.100.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T02:40:54.119Z",
      "x_nadsec_last_seen": "2026-05-20T06:39:11.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--5e7c77d4-f888-4d4f-99f9-ced89e27bf56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.80.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T02:56:56.135Z",
      "x_nadsec_last_seen": "2026-05-20T02:59:02.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--720227a4-17d1-4642-833d-af0e771efc8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.25.110.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T02:11:02.019Z",
      "x_nadsec_last_seen": "2026-05-20T02:13:06.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2888a66c-71e8-49d4-8ad5-dff546010227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T02:21:10.358Z",
      "x_nadsec_last_seen": "2026-05-20T02:21:10.358Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=37611; asn_org=AFRIHOST-SP",
      "id": "indicator--a7d587df-9000-4e18-a835-e009f814410c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '169.0.119.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T02:54:38.245Z",
      "x_nadsec_last_seen": "2026-05-20T02:56:46.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37611"
      ],
      "x_nadsec_orgs": [
        "AFRIHOST-SP"
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=271218; asn_org=AL TELECOM - TELECOMUNICACOES LTDA",
      "id": "indicator--59a77135-2411-49cc-bb61-b036afb844a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.10.136.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T02:24:11.061Z",
      "x_nadsec_last_seen": "2026-05-20T02:24:11.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271218"
      ],
      "x_nadsec_orgs": [
        "AL TELECOM - TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c98fb897-864d-4138-b181-2a167dfab483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.180.218.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T02:46:34.221Z",
      "x_nadsec_last_seen": "2026-05-20T02:46:34.411Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-20T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--14e670ed-2aa5-481c-b8fd-5d17017b3640",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.78.113.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:05:10.000Z",
      "valid_until": "2026-06-21T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T02:29:56.078Z",
      "x_nadsec_last_seen": "2026-05-20T02:29:56.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--0a4c216c-4d06-4df1-8a39-d76a4e3becef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.53.37.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T03:58:45.875Z",
      "x_nadsec_last_seen": "2026-05-20T03:58:51.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--fc6d63d9-e747-40e3-8524-3691d07c431f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.211.69.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T03:30:00.800Z",
      "x_nadsec_last_seen": "2026-05-20T03:32:06.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2996da16-ac0a-438e-8ab2-e69c260215e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.110.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-20T03:48:21.998Z",
      "x_nadsec_last_seen": "2026-05-20T13:28:56.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e9158d2d-276f-48af-af56-2b2b052c63fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.210.121.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T03:18:43.382Z",
      "x_nadsec_last_seen": "2026-05-23T19:19:24.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=44443; asn_org=LLC Inovatsiyni Telekomunikatsii",
      "id": "indicator--459c5cd8-0391-4d76-931e-b209ce39d32b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.227.244.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T03:32:39.488Z",
      "x_nadsec_last_seen": "2026-05-20T03:39:34.058Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "44443"
      ],
      "x_nadsec_orgs": [
        "LLC Inovatsiyni Telekomunikatsii"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--f7cc4e63-83e5-4ceb-93d9-0ab2b4d2cd68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.170.206.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T03:28:46.360Z",
      "x_nadsec_last_seen": "2026-05-20T03:28:53.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--0f7faeaa-b5f4-4cf7-bf78-dd0f4eb98197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.126.78.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T04:01:16.413Z",
      "x_nadsec_last_seen": "2026-05-20T04:06:12.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e82d1524-fa6c-438a-a028-7242bb7cd736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.69.64.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T03:44:24.574Z",
      "x_nadsec_last_seen": "2026-05-20T03:59:47.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8ac464d1-ac04-45b0-9d1f-2eaee6c5de06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.144.254.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T03:20:27.343Z",
      "x_nadsec_last_seen": "2026-05-20T03:20:27.343Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-20T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1ac3c391-8260-48b0-abcf-c191a27b49f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.245.21.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:05:11.000Z",
      "valid_until": "2026-06-21T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T03:51:11.518Z",
      "x_nadsec_last_seen": "2026-05-20T03:53:16.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135357; asn_org=HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED; user(top)=r**t",
      "id": "indicator--ebad4074-b6a9-47fd-a12d-34dc6d682688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.20.194.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T04:17:42.814Z",
      "x_nadsec_last_seen": "2026-05-27T09:06:43.035Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135357"
      ],
      "x_nadsec_orgs": [
        "HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "m****d"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--1aa812d8-e164-42b7-8a0c-7852f468f9d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:13:29.746Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:46.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2b808a2a-6955-4093-8045-c1f669609d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:13:03.082Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:04.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--e0d08ade-1b74-43b7-a775-d15a4f925817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.123.100.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T04:41:19.636Z",
      "x_nadsec_last_seen": "2026-05-20T04:43:25.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--97f5ab4b-2c8a-4b1b-855d-3c63d2a20e91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:26:33.999Z",
      "x_nadsec_last_seen": "2026-05-24T03:34:54.022Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--1f42a9c5-31cd-4e33-9b67-00657c6f3dbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.44.138.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T04:40:19.144Z",
      "x_nadsec_last_seen": "2026-05-20T04:40:19.144Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=US; asn=31898; asn_org=Oracle Corporation",
      "id": "indicator--3a059d16-04da-45a8-84da-ea9d4f559aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.70.144.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 6906,
      "x_nadsec_first_seen": "2026-05-20T04:41:53.852Z",
      "x_nadsec_last_seen": "2026-05-24T11:38:34.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "31898"
      ],
      "x_nadsec_orgs": [
        "Oracle Corporation"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--ee9908e1-0292-4f97-9572-a1a16cd598b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T04:30:09.144Z",
      "x_nadsec_last_seen": "2026-05-24T10:21:04.864Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=52682; asn_org=AVATO TECNOLOGIA S.A; user(top)=**",
      "id": "indicator--cc05f6d7-4b37-47a8-8840-680fd274f515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.221.205.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T04:13:38.289Z",
      "x_nadsec_last_seen": "2026-05-20T04:13:38.289Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52682"
      ],
      "x_nadsec_orgs": [
        "AVATO TECNOLOGIA S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b323bc15-1403-4a2f-bca3-4493c60a42f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.118.199.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T04:09:05.645Z",
      "x_nadsec_last_seen": "2026-05-20T04:11:12.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=PA; asn=18809; asn_org=Cable Onda",
      "id": "indicator--429e0322-c108-4782-926b-f1e672c230de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.46.56.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T04:15:06.550Z",
      "x_nadsec_last_seen": "2026-05-20T04:53:56.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "18809"
      ],
      "x_nadsec_orgs": [
        "Cable Onda"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--9ecde781-f464-4213-9c30-0fd9c9864c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.51.102.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T04:35:36.443Z",
      "x_nadsec_last_seen": "2026-05-20T04:37:40.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--469fff75-b4f0-47bb-a803-39bce634e371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.77.226.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T04:44:17.167Z",
      "x_nadsec_last_seen": "2026-05-20T04:44:17.167Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--52c6f886-76ad-4163-b08e-0af4cf6ad2ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.36.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T04:33:47.587Z",
      "x_nadsec_last_seen": "2026-05-20T04:33:47.587Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--00f32cae-b9db-4121-83ad-1f8cd0fb7393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.65.211.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T04:22:30.820Z",
      "x_nadsec_last_seen": "2026-05-20T04:22:31.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-05-20T05:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--df8879bd-52c5-4d25-897f-7d9cefdd1dc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T05:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.218.204.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:05:28.000Z",
      "valid_until": "2026-06-21T05:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T04:44:18.758Z",
      "x_nadsec_last_seen": "2026-05-20T04:46:25.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--8e87a255-f412-493f-85bf-f062ba816593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.144.179.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T06:56:04.529Z",
      "x_nadsec_last_seen": "2026-05-20T06:56:04.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6942741f-e57e-4fd3-a5f7-1e4687e77f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.208.255.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T06:23:40.527Z",
      "x_nadsec_last_seen": "2026-05-20T06:25:48.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a795bc3b-bb60-4030-8e36-bd190522b8aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.144.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-20T06:34:11.735Z",
      "x_nadsec_last_seen": "2026-05-24T01:12:40.411Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "27017",
        "33845"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=7470; asn_org=TRUE INTERNET Co.,Ltd.",
      "id": "indicator--07c6fe26-7941-46ef-92cb-69df83a052c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.103.89.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T06:53:03.398Z",
      "x_nadsec_last_seen": "2026-05-20T06:55:07.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "7470"
      ],
      "x_nadsec_orgs": [
        "TRUE INTERNET Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f570288e-3865-4091-9937-4dd4aaee81fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.19.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T06:15:30.928Z",
      "x_nadsec_last_seen": "2026-05-20T06:23:02.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e88d6af1-6dba-40f0-9bd2-c26789d64c19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T06:48:07.376Z",
      "x_nadsec_last_seen": "2026-05-20T06:48:07.376Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e5b095c2-c04e-48ff-96c6-1191faf194e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T06:55:36.989Z",
      "x_nadsec_last_seen": "2026-05-20T06:55:37.655Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--89733341-eb13-486b-a7ff-953201d0f4dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T06:48:07.119Z",
      "x_nadsec_last_seen": "2026-05-20T06:48:07.119Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0c13ce14-e7a3-4ce9-8e1b-5b18f7d955ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T06:36:33.354Z",
      "x_nadsec_last_seen": "2026-05-20T06:36:33.354Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=2715; asn_org=Fundacao Carlos Chagas Filho de Amparo a Pesquisa",
      "id": "indicator--b8481cad-a230-477f-82b6-8c77699df44a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.156.147.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T06:18:57.492Z",
      "x_nadsec_last_seen": "2026-05-20T06:21:05.047Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "2715"
      ],
      "x_nadsec_orgs": [
        "Fundacao Carlos Chagas Filho de Amparo a Pesquisa"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--ef357e44-dc21-440c-a914-071e3a6283cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.51.124.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-20T06:25:55.686Z",
      "x_nadsec_last_seen": "2026-05-25T02:05:54.562Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e4d27291-6914-4d2a-96ea-73b3a8be7cd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.81.64.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T06:53:59.570Z",
      "x_nadsec_last_seen": "2026-05-20T06:56:03.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--00ddae1e-3224-4603-b24d-92ef97e7bc2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.180.137.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T06:44:54.767Z",
      "x_nadsec_last_seen": "2026-05-20T06:44:55.467Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--a8c38136-ff7e-4960-bac4-6b1a34e4dfe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.86.193.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T07:03:31.132Z",
      "x_nadsec_last_seen": "2026-05-20T07:03:31.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=49800; asn_org=GNC-Alfa CJSC",
      "id": "indicator--bafe7857-74a1-4a8e-848f-29e7d4f1bc50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.89.27.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T06:34:29.917Z",
      "x_nadsec_last_seen": "2026-05-20T06:36:37.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "49800"
      ],
      "x_nadsec_orgs": [
        "GNC-Alfa CJSC"
      ]
    },
    {
      "created": "2026-05-20T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=10796; asn_org=Charter Communications Inc",
      "id": "indicator--820bfd27-cfbd-4c3d-b507-a250e32caaee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '70.61.34.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T07:05:02.000Z",
      "valid_until": "2026-06-21T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T06:58:30.176Z",
      "x_nadsec_last_seen": "2026-05-20T07:00:35.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10796"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--700325c1-90fc-4f19-be1f-539d20c03fc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.74.251.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-20T07:43:50.439Z",
      "x_nadsec_last_seen": "2026-05-31T04:56:51.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=38712; asn_org=Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne",
      "id": "indicator--21c5004c-c303-4b3c-b825-5c08e51b381a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.50.18.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T07:24:18.122Z",
      "x_nadsec_last_seen": "2026-05-20T07:24:24.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38712"
      ],
      "x_nadsec_orgs": [
        "Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--eac84cb7-3712-4468-9d75-fa152d7069c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.252.174.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T08:03:22.296Z",
      "x_nadsec_last_seen": "2026-05-20T08:08:05.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--397c9ab4-226c-4627-a00c-de46516f2b25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.203.200.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T07:35:16.550Z",
      "x_nadsec_last_seen": "2026-05-20T07:35:26.901Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--51c1aa80-2310-40a0-8907-6b3f99d47db6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.255.116.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T07:19:14.373Z",
      "x_nadsec_last_seen": "2026-05-20T07:21:20.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--86a30b23-bebd-43f6-ba21-6147175a79fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.8.100.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T08:01:18.213Z",
      "x_nadsec_last_seen": "2026-05-20T08:03:23.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=31149; asn_org=Shtoler Vitaliy Andreevich",
      "id": "indicator--ccb26c5a-9829-45fc-9f02-4f2f8ffa58da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.211.213.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T07:13:26.384Z",
      "x_nadsec_last_seen": "2026-05-20T07:15:33.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "31149"
      ],
      "x_nadsec_orgs": [
        "Shtoler Vitaliy Andreevich"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28649; asn_org=Desktop Sigmanet Comunicacao Multimidia SA",
      "id": "indicator--f285dd98-d9e3-468c-b065-34361641ba9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.77.190.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T07:29:43.069Z",
      "x_nadsec_last_seen": "2026-05-20T07:31:49.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28649"
      ],
      "x_nadsec_orgs": [
        "Desktop Sigmanet Comunicacao Multimidia SA"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--74881bf5-2472-4c71-acb6-d54eb955ee03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.135.253.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T07:19:41.347Z",
      "x_nadsec_last_seen": "2026-05-20T07:21:48.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--e5adfc59-2989-4ab3-a0fa-67853a81f457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.200.135.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T07:36:39.867Z",
      "x_nadsec_last_seen": "2026-05-31T20:21:20.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--17664a58-2de4-494d-8cd3-1e00dfc60c91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.37.231.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T07:28:22.756Z",
      "x_nadsec_last_seen": "2026-05-20T07:30:29.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=US; asn=202015; asn_org=HZ Hosting Ltd",
      "id": "indicator--dca30a04-2505-417d-8f00-82eef1147302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.142.240.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T08:05:11.000Z",
      "valid_until": "2026-06-21T08:05:09.000Z",
      "x_nadsec_event_count": 30,
      "x_nadsec_first_seen": "2026-05-20T07:46:23.858Z",
      "x_nadsec_last_seen": "2026-05-20T12:32:49.397Z",
      "x_nadsec_ports": [
        "81",
        "3306",
        "21",
        "135",
        "445",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "epmapper",
        "ftpd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202015"
      ],
      "x_nadsec_orgs": [
        "HZ Hosting Ltd"
      ]
    },
    {
      "created": "2026-05-20T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--67300684-7db0-4299-b184-bfe084b3ceea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.51.40.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:05:13.000Z",
      "valid_until": "2026-06-21T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T09:04:29.600Z",
      "x_nadsec_last_seen": "2026-05-20T09:06:34.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-20T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--723e8f49-48e8-4c81-872b-9bd9dadff705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.206.171.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:05:13.000Z",
      "valid_until": "2026-06-21T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T09:55:05.871Z",
      "x_nadsec_last_seen": "2026-05-20T09:57:13.103Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-20T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--de1b56e5-731a-4cbd-abaf-2e43f32cbbbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.208.136.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:05:13.000Z",
      "valid_until": "2026-06-21T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T09:32:47.121Z",
      "x_nadsec_last_seen": "2026-05-20T09:40:31.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-20T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--3788e15d-b735-4c90-8634-d847eafee109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:05:13.000Z",
      "valid_until": "2026-06-21T10:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-20T08:11:49.290Z",
      "x_nadsec_last_seen": "2026-05-20T10:02:14.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-20T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=201127; asn_org=Fastfone s.r.l.",
      "id": "indicator--39f63664-41cd-40c4-98eb-58a3504f764a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.84.91.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:05:13.000Z",
      "valid_until": "2026-06-21T10:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-20T09:33:29.578Z",
      "x_nadsec_last_seen": "2026-05-22T08:15:40.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "201127"
      ],
      "x_nadsec_orgs": [
        "Fastfone s.r.l."
      ]
    },
    {
      "created": "2026-05-20T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=55501; asn_org=141-143 Maulana Shaukat Ali Road",
      "id": "indicator--51ea1126-2cad-4459-952c-fe96cb5d13aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.166.175.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:05:13.000Z",
      "valid_until": "2026-06-21T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T09:56:17.058Z",
      "x_nadsec_last_seen": "2026-05-20T09:58:31.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "55501"
      ],
      "x_nadsec_orgs": [
        "141-143 Maulana Shaukat Ali Road"
      ]
    },
    {
      "created": "2026-05-20T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--81328fbc-5c1b-4aed-969e-a01f5601be22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.72.73.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:05:13.000Z",
      "valid_until": "2026-06-21T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T09:20:11.561Z",
      "x_nadsec_last_seen": "2026-05-20T09:26:50.413Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--b5c2508f-a690-4f8a-b306-735e844784a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.99.3.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T11:54:03.418Z",
      "x_nadsec_last_seen": "2026-05-20T11:56:08.233Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--23d05474-5ca2-49c0-9b3b-9d3a0f24f2ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.86.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T11:20:47.482Z",
      "x_nadsec_last_seen": "2026-05-20T11:20:47.482Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--d7793e38-d22f-4c27-944e-2f216af72cc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.0.23.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T12:01:58.264Z",
      "x_nadsec_last_seen": "2026-05-20T12:04:03.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c973b386-8ffc-45ec-8704-ffa9d94f5990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.249.97.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T11:43:05.679Z",
      "x_nadsec_last_seen": "2026-05-20T11:45:13.530Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=17465; asn_org=Cable ISP in India",
      "id": "indicator--deb04c9f-fb0e-4f9c-bced-28721aa78b4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.164.156.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T11:14:44.077Z",
      "x_nadsec_last_seen": "2026-05-20T11:14:44.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17465"
      ],
      "x_nadsec_orgs": [
        "Cable ISP in India"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17771; asn_org=Southern Online Bio Technologies Ltd",
      "id": "indicator--6f086b96-bd77-4260-83d3-67ddec5c8680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.63.107.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T11:23:37.717Z",
      "x_nadsec_last_seen": "2026-05-20T11:25:42.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17771"
      ],
      "x_nadsec_orgs": [
        "Southern Online Bio Technologies Ltd"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ec196b1e-9cb7-46a6-af75-72d6b222a509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.68.102.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T11:06:57.403Z",
      "x_nadsec_last_seen": "2026-05-20T11:13:26.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--eaac2875-2cc0-4024-aa2f-0f44dd9b08bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.33.205.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T12:00:19.074Z",
      "x_nadsec_last_seen": "2026-05-20T12:01:10.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8a4e10ca-f3e8-41f7-a366-db276eda9ed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.15.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T11:37:11.920Z",
      "x_nadsec_last_seen": "2026-05-20T11:39:18.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262847; asn_org=DBUG TELECOM LTDA",
      "id": "indicator--7485b147-372d-4d48-9a70-0bc527f122bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.225.66.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T11:45:47.182Z",
      "x_nadsec_last_seen": "2026-05-20T11:47:53.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262847"
      ],
      "x_nadsec_orgs": [
        "DBUG TELECOM LTDA"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=5617; asn_org=Orange Polska Spolka Akcyjna",
      "id": "indicator--8c426df0-b0cd-4ce1-bcc9-29e0ac7a720a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.13.235.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T11:49:58.177Z",
      "x_nadsec_last_seen": "2026-05-20T13:19:34.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "5617"
      ],
      "x_nadsec_orgs": [
        "Orange Polska Spolka Akcyjna"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=58289; asn_org=Kazakhstan Network Communication LLP",
      "id": "indicator--7e2251cb-4c3e-4c71-8bc6-e33de8a815fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.147.111.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T11:57:48.896Z",
      "x_nadsec_last_seen": "2026-05-20T12:04:11.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "58289"
      ],
      "x_nadsec_orgs": [
        "Kazakhstan Network Communication LLP"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=39173; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6737886a-c59d-4d19-ad2d-14abafe16f71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T11:55:59.794Z",
      "x_nadsec_last_seen": "2026-05-20T11:55:59.798Z",
      "x_nadsec_ports": [
        "42",
        "39173"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1ddad8ea-2536-43c4-8ff3-325cb2739874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.101.192.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:05:05.000Z",
      "valid_until": "2026-06-21T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T11:53:14.830Z",
      "x_nadsec_last_seen": "2026-05-20T11:55:21.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T13:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--8f78aaba-1583-4b48-a65f-15aae7063b10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.77.134.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:05:25.000Z",
      "valid_until": "2026-06-21T13:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-20T12:09:47.344Z",
      "x_nadsec_last_seen": "2026-05-24T02:40:42.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-20T13:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--779c0f72-25d0-444d-a57d-187b6069a18a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.123.96.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:05:25.000Z",
      "valid_until": "2026-06-21T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T12:12:27.538Z",
      "x_nadsec_last_seen": "2026-05-20T12:14:32.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-20T13:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--05352936-a05c-49c6-ad73-0777f0046e5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.198.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:05:25.000Z",
      "valid_until": "2026-06-21T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T12:11:37.173Z",
      "x_nadsec_last_seen": "2026-05-20T12:11:37.173Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T13:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HU; asn=20845; asn_org=DIGI Tavkozlesi es Szolgaltato Kft.",
      "id": "indicator--df8088f9-c4ec-4cbe-bab9-2ba489010bc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.164.218.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:05:25.000Z",
      "valid_until": "2026-06-21T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T12:10:44.148Z",
      "x_nadsec_last_seen": "2026-05-20T12:12:50.482Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "20845"
      ],
      "x_nadsec_orgs": [
        "DIGI Tavkozlesi es Szolgaltato Kft."
      ]
    },
    {
      "created": "2026-05-20T13:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--31b19b88-24d1-4344-90d6-bc45a7fc2ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.118.136.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:05:25.000Z",
      "valid_until": "2026-06-21T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T12:44:57.441Z",
      "x_nadsec_last_seen": "2026-05-20T15:15:29.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-05-20T13:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--30214f74-3d31-40a3-8054-0b3fa025cc23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.189.189.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:05:25.000Z",
      "valid_until": "2026-06-21T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T12:59:56.930Z",
      "x_nadsec_last_seen": "2026-05-20T12:59:56.930Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-05-20T13:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--3f67b1df-dce4-4f1f-92cf-7964e1c63f47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T13:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.51.114.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:05:25.000Z",
      "valid_until": "2026-06-21T13:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T12:08:58.700Z",
      "x_nadsec_last_seen": "2026-05-20T13:32:25.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2a5e485b-5ca6-47b9-818d-e8c7065aac1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T15:22:15.311Z",
      "x_nadsec_last_seen": "2026-05-20T15:22:15.311Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=24203; asn_org=PT XL Axiata",
      "id": "indicator--0b79332e-ac0b-4092-85c6-fde9495b3de7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '140.213.219.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T15:56:56.884Z",
      "x_nadsec_last_seen": "2026-05-20T15:59:02.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24203"
      ],
      "x_nadsec_orgs": [
        "PT XL Axiata"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fb2b1927-8037-4664-9b1f-9a9652632366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T15:21:48.667Z",
      "x_nadsec_last_seen": "2026-05-20T15:21:48.667Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--56f0b297-8dc9-49bf-b3e2-eeee33229ee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.230.150.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T15:49:24.417Z",
      "x_nadsec_last_seen": "2026-05-20T15:50:04.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--112922fe-b68b-4312-aa59-061560b8b3af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.0.80.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T15:41:48.549Z",
      "x_nadsec_last_seen": "2026-05-20T15:41:48.549Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=epmapper; ports=135; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b5a667a5-1973-4a7b-aa5f-fcf46e525154",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.32.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-20T15:17:11.901Z",
      "x_nadsec_last_seen": "2026-05-20T15:35:23.504Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ef0cbb50-d64c-465b-a33e-ec76528039ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.130.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T15:16:54.341Z",
      "x_nadsec_last_seen": "2026-05-20T15:16:54.341Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--9e10b2d0-2226-403b-a355-3bcb7395a6ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-20T15:51:19.900Z",
      "x_nadsec_last_seen": "2026-05-21T16:27:47.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CA; asn=6327; asn_org=Shaw Communications",
      "id": "indicator--0483c586-7ce0-49ec-acdd-5de57c9f7a16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.67.46.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-20T15:51:05.813Z",
      "x_nadsec_last_seen": "2026-05-22T10:31:47.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "6327"
      ],
      "x_nadsec_orgs": [
        "Shaw Communications"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d85733f4-46b6-46b7-b6c6-2b6adb0a75cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.254.230.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T15:07:33.131Z",
      "x_nadsec_last_seen": "2026-05-20T15:14:33.385Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--fea5da50-a595-4d29-9b3e-622a98b653fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.95.23.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T15:52:26.569Z",
      "x_nadsec_last_seen": "2026-05-20T15:53:31.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=51197; asn_org=FOP Nayman Olha Vladimirovna",
      "id": "indicator--84cf06dd-6bbc-4a37-946c-4d4d09b93101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.43.70.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T16:01:25.818Z",
      "x_nadsec_last_seen": "2026-05-20T16:03:32.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "51197"
      ],
      "x_nadsec_orgs": [
        "FOP Nayman Olha Vladimirovna"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--e500fddb-a6e6-47a7-836d-f57854303eb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.248.238.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-20T15:18:22.891Z",
      "x_nadsec_last_seen": "2026-05-27T13:03:15.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=28015; asn_org=MERCO COMUNICACIONES",
      "id": "indicator--90cb250f-5ec8-4641-afd1-ad2edd088ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.219.168.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T15:43:04.657Z",
      "x_nadsec_last_seen": "2026-05-20T17:49:34.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28015"
      ],
      "x_nadsec_orgs": [
        "MERCO COMUNICACIONES"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--07b5d167-ea60-4bb9-9a39-a15c3cc27720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.205.114.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T15:32:46.761Z",
      "x_nadsec_last_seen": "2026-05-29T10:32:27.449Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9658; asn_org=Eastern Telecoms Phils., Inc.",
      "id": "indicator--6133c3d2-5eb7-4726-9baf-db355249a343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.28.158.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T15:57:07.457Z",
      "x_nadsec_last_seen": "2026-05-20T16:04:11.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9658"
      ],
      "x_nadsec_orgs": [
        "Eastern Telecoms Phils., Inc."
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--9e034cdd-3d83-43fa-85e3-4add99331489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.214.72.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T15:51:40.981Z",
      "x_nadsec_last_seen": "2026-05-20T15:58:48.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--ffde4a18-95c5-4454-99da-d1c135400c3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:05:02.000Z",
      "valid_until": "2026-06-21T16:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T15:16:12.000Z",
      "x_nadsec_last_seen": "2026-05-20T15:18:17.122Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--0b7caeb3-8919-44b2-af76-4da7f0130e15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.117.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T17:57:57.132Z",
      "x_nadsec_last_seen": "2026-05-20T18:00:04.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--355b0a2d-93d3-4382-8f28-32a3aa5f8f62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.91.4.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T17:39:24.359Z",
      "x_nadsec_last_seen": "2026-05-20T17:39:24.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--9b24565d-b035-435b-bcda-b2f1a712c122",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.91.4.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T17:39:22.317Z",
      "x_nadsec_last_seen": "2026-05-20T17:39:22.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=HK; asn=9304; asn_org=HGC Global Communications Limited",
      "id": "indicator--446fa8b6-2d2e-46a5-b4af-c8d7478424e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.253.69.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-20T17:52:30.733Z",
      "x_nadsec_last_seen": "2026-05-20T17:53:38.242Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9304"
      ],
      "x_nadsec_orgs": [
        "HGC Global Communications Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****1"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=58765; asn_org=B TEL INTERNET PRIVATE LIMITED",
      "id": "indicator--32d88e51-0662-4689-8c61-a720adf27d64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.124.42.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T17:54:21.941Z",
      "x_nadsec_last_seen": "2026-05-26T23:41:44.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58765"
      ],
      "x_nadsec_orgs": [
        "B TEL INTERNET PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--8bb609af-94fa-4d3d-8b92-ab6a90a25162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-20T17:38:03.274Z",
      "x_nadsec_last_seen": "2026-05-25T23:03:15.141Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--0e391335-45f0-4e11-8d94-f093077f9cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.241.50.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T17:49:18.973Z",
      "x_nadsec_last_seen": "2026-05-20T20:03:22.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d3febe87-eaca-4b05-9db3-e6ca47fb6959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.96.26.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T17:41:32.208Z",
      "x_nadsec_last_seen": "2026-05-20T17:43:37.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--172626fd-bb3f-4b85-a5a9-ee260dd0e198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T17:10:11.410Z",
      "x_nadsec_last_seen": "2026-05-20T17:10:11.410Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9f861523-2311-4539-97b1-8ea63f4e4dcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T17:10:12.374Z",
      "x_nadsec_last_seen": "2026-05-20T17:10:12.374Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--741b6276-b592-4494-8a13-da43dba52f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.70.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T17:37:16.886Z",
      "x_nadsec_last_seen": "2026-05-20T17:37:16.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--1852ed07-c2b9-4219-8020-5016cd293979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.71.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T17:37:17.295Z",
      "x_nadsec_last_seen": "2026-05-20T17:37:17.295Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-20T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--b6bbe81c-0827-4bf5-8abf-2a759837d861",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.39.83.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T18:05:10.000Z",
      "valid_until": "2026-06-21T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-20T17:30:53.271Z",
      "x_nadsec_last_seen": "2026-05-20T17:32:20.108Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-20T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28233; asn_org=I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP",
      "id": "indicator--370e21e1-84dd-4540-9685-8b5b9c997c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.194.47.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:05:02.000Z",
      "valid_until": "2026-06-21T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T19:52:12.719Z",
      "x_nadsec_last_seen": "2026-05-20T19:52:19.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28233"
      ],
      "x_nadsec_orgs": [
        "I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP"
      ]
    },
    {
      "created": "2026-05-20T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c32c5d30-a961-46b4-ab02-101bc0acccde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:05:02.000Z",
      "valid_until": "2026-06-21T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T19:43:09.930Z",
      "x_nadsec_last_seen": "2026-05-20T19:43:09.930Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a8570945-43ac-4782-bf8f-f9f4855e855a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:05:02.000Z",
      "valid_until": "2026-06-21T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T19:43:11.182Z",
      "x_nadsec_last_seen": "2026-05-20T19:43:11.182Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=15895; asn_org=Kyivstar PJSC",
      "id": "indicator--86dc2aa0-e14b-4b40-9916-3c1c3c5ea0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.223.236.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:05:02.000Z",
      "valid_until": "2026-06-21T20:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T19:20:20.420Z",
      "x_nadsec_last_seen": "2026-05-20T19:28:45.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15895"
      ],
      "x_nadsec_orgs": [
        "Kyivstar PJSC"
      ]
    },
    {
      "created": "2026-05-20T21:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cba22fa5-e8ce-4cbd-ac81-1e7023cd4f4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.60.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:05:39.000Z",
      "valid_until": "2026-06-21T21:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T20:49:31.977Z",
      "x_nadsec_last_seen": "2026-05-20T20:49:31.977Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-20T21:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--bbe30a0c-5c6e-4ca7-bc31-870ef5ba79a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.172.105.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:05:39.000Z",
      "valid_until": "2026-06-21T21:05:13.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-20T20:09:00.379Z",
      "x_nadsec_last_seen": "2026-05-20T20:24:24.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-20T21:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fc9aaf2e-3a49-4e39-a37c-2015917f6627",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:05:39.000Z",
      "valid_until": "2026-06-21T21:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T20:27:39.314Z",
      "x_nadsec_last_seen": "2026-05-20T20:27:39.648Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-20T21:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=13767; asn_org=DataBank Holdings, Ltd.",
      "id": "indicator--4174a518-a30f-4a3d-83d5-6dc9715a4191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.18.11.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:05:39.000Z",
      "valid_until": "2026-06-21T21:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T20:38:51.629Z",
      "x_nadsec_last_seen": "2026-05-20T20:38:51.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "13767"
      ],
      "x_nadsec_orgs": [
        "DataBank Holdings, Ltd."
      ]
    },
    {
      "created": "2026-05-20T21:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--401c3d37-4e7d-44e3-8f31-2f0c0721ed65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T21:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.35.136.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:05:39.000Z",
      "valid_until": "2026-06-21T21:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T20:57:44.242Z",
      "x_nadsec_last_seen": "2026-05-20T20:59:51.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e8587044-dc4c-4219-8c94-f93074fa4e5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.172.27.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T22:04:09.705Z",
      "x_nadsec_last_seen": "2026-05-20T22:06:16.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--7170bfb5-f222-4bb9-bde0-503440dab77d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.0.22.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T22:37:42.018Z",
      "x_nadsec_last_seen": "2026-05-20T22:39:47.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7d1f91e3-601a-4d1c-8f1b-f2a0dfa91c77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T22:20:14.428Z",
      "x_nadsec_last_seen": "2026-05-20T22:20:14.428Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GT; asn=52468; asn_org=UFINET PANAMA S.A.",
      "id": "indicator--dbfc8322-d9d8-4e3e-8d2c-5a99686c9ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.119.109.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T22:38:23.474Z",
      "x_nadsec_last_seen": "2026-05-20T22:45:25.355Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GT"
      ],
      "x_nadsec_asns": [
        "52468"
      ],
      "x_nadsec_orgs": [
        "UFINET PANAMA S.A."
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=142; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--d1df47cd-1c82-4870-be16-a1671d967f74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 284,
      "x_nadsec_first_seen": "2026-05-20T22:10:26.840Z",
      "x_nadsec_last_seen": "2026-05-23T20:04:22.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9617d9e2-65e7-46fa-bf34-a76a515a91fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.61.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T23:02:37.757Z",
      "x_nadsec_last_seen": "2026-05-20T23:02:47.899Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--76c5992b-4aab-4ad6-ad10-60fbe8b214d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T22:59:40.245Z",
      "x_nadsec_last_seen": "2026-05-20T22:59:40.245Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-20T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-20T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:05:10.000Z",
      "valid_until": "2026-06-21T23:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T22:59:50.643Z",
      "x_nadsec_last_seen": "2026-05-20T22:59:50.643Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--76d16c67-87d9-4520-8041-4680150cf303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.27.178.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T23:46:52.892Z",
      "x_nadsec_last_seen": "2026-05-20T23:46:52.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=27839; asn_org=Comteco Ltda",
      "id": "indicator--01f78a17-6eb6-43dd-9169-221e8af4771b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.177.141.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T23:07:56.459Z",
      "x_nadsec_last_seen": "2026-05-29T11:26:41.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "27839"
      ],
      "x_nadsec_orgs": [
        "Comteco Ltda"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--796bc7e5-1b85-41b0-b65a-f9179fd657bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.103.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-05-20T23:15:59.543Z",
      "x_nadsec_last_seen": "2026-05-23T11:12:53.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bf943747-cf62-453b-91cc-8d17fcd93872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-20T23:26:35.428Z",
      "x_nadsec_last_seen": "2026-05-20T23:26:35.428Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--ee042b0f-42c6-42c9-b206-9d209fb819b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.27.85.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T23:14:41.766Z",
      "x_nadsec_last_seen": "2026-05-20T23:16:48.276Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--37c1d41e-1b16-40f2-b690-3a1ddcfb0c0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.115.147.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T23:56:36.802Z",
      "x_nadsec_last_seen": "2026-05-20T23:58:42.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KG; asn=41750; asn_org=Mega-Line Ltd.",
      "id": "indicator--cc040875-fd7f-4463-8ef2-8c5c93a71026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.235.20.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T23:55:02.999Z",
      "x_nadsec_last_seen": "2026-05-20T23:55:03.064Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "41750"
      ],
      "x_nadsec_orgs": [
        "Mega-Line Ltd."
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=12741; asn_org=Netia SA",
      "id": "indicator--306287fb-6c84-430f-88fd-9ede282e9d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.10.183.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T23:50:12.906Z",
      "x_nadsec_last_seen": "2026-05-20T23:52:19.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "12741"
      ],
      "x_nadsec_orgs": [
        "Netia SA"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=15774; asn_org=Limited Liability Company TTK-Svyaz",
      "id": "indicator--ab87b180-3e8f-43c1-aceb-4ee23fdc1979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.4.255.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T23:59:32.264Z",
      "x_nadsec_last_seen": "2026-05-21T00:01:39.153Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "15774"
      ],
      "x_nadsec_orgs": [
        "Limited Liability Company TTK-Svyaz"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=6849; asn_org=JSC Ukrtelecom",
      "id": "indicator--467c18c4-5fca-4c4f-935c-0fb87414605e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.207.2.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-20T23:17:03.005Z",
      "x_nadsec_last_seen": "2026-05-20T23:19:09.393Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6849"
      ],
      "x_nadsec_orgs": [
        "JSC Ukrtelecom"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--c540e265-a35f-4e92-ac2e-1cbd2ccb4c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.164.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-20T23:26:25.197Z",
      "x_nadsec_last_seen": "2026-05-20T23:34:53.722Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-21T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--771828b4-c58e-4e12-a6cd-27b8d61bc60c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.164.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:05:14.000Z",
      "valid_until": "2026-06-22T00:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T00:00:11.748Z",
      "x_nadsec_last_seen": "2026-05-21T00:01:32.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=131111; asn_org=PT Mora Telematika Indonesia",
      "id": "indicator--5597565d-f447-4807-881d-9fbc65d32274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.174.36.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T00:23:38.401Z",
      "x_nadsec_last_seen": "2026-05-21T00:29:51.561Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131111"
      ],
      "x_nadsec_orgs": [
        "PT Mora Telematika Indonesia"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mysqld; ports=3306; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f8dabd1f-8ac5-46df-9250-4f19bb547711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.187.248.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-21T00:55:03.246Z",
      "x_nadsec_last_seen": "2026-05-26T23:43:30.645Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f5ae8a15-6906-4a6a-8278-f695864be67c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.187.249.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T00:55:03.267Z",
      "x_nadsec_last_seen": "2026-05-26T23:43:30.652Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d8d8d10a-ddbf-4e95-ae12-95141ebc99d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.187.249.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T00:55:03.262Z",
      "x_nadsec_last_seen": "2026-05-26T23:43:30.656Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--54f8dcc1-00a9-4d1a-bddf-5760359eb4eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.230.238.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T00:34:53.988Z",
      "x_nadsec_last_seen": "2026-05-21T00:34:59.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; user(top)=r**t",
      "id": "indicator--3151416f-6757-4907-89dd-74e0ad76e7a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.178.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T00:20:57.394Z",
      "x_nadsec_last_seen": "2026-05-21T00:21:19.032Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b8c22f9d-a065-4ddb-8788-634e1660a6ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.138.214.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T00:52:31.781Z",
      "x_nadsec_last_seen": "2026-05-21T01:00:04.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--0260b4e7-2761-4c96-9fc3-6b7806ece872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.203.200.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T00:54:16.480Z",
      "x_nadsec_last_seen": "2026-05-21T00:54:16.480Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AE; asn=15802; asn_org=Emirates Integrated Telecommunications Company PJSC",
      "id": "indicator--8a39cd2a-c318-42c1-8fb4-6b176b6eda97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.32.92.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T00:21:33.630Z",
      "x_nadsec_last_seen": "2026-05-21T00:28:56.225Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "15802"
      ],
      "x_nadsec_orgs": [
        "Emirates Integrated Telecommunications Company PJSC"
      ]
    },
    {
      "created": "2026-05-21T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:05:04.000Z",
      "valid_until": "2026-06-22T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T00:31:50.981Z",
      "x_nadsec_last_seen": "2026-05-21T00:31:50.981Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--53218435-f995-491a-a705-38b3c6cee35f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.180.169.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T01:48:53.590Z",
      "x_nadsec_last_seen": "2026-05-21T01:48:53.590Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b886a116-ae64-4e67-a500-dbd85a15ebae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.108.106.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T01:55:24.093Z",
      "x_nadsec_last_seen": "2026-05-21T16:03:43.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--67cdd67d-35c1-4790-be8a-15848be93680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.3.93.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-21T01:48:43.880Z",
      "x_nadsec_last_seen": "2026-05-21T07:36:47.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--192158dc-4119-45df-8598-7d081601734f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.115.243.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T01:06:08.503Z",
      "x_nadsec_last_seen": "2026-05-21T01:13:29.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f3d24905-4623-4a8e-bf50-f9b402db272b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.106.56.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T01:58:57.534Z",
      "x_nadsec_last_seen": "2026-05-21T01:58:57.534Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=18233; asn_org=Philippine Telegraph and Telephone Corporation",
      "id": "indicator--d8989c06-7a0e-4163-8a3a-479b803a0b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.160.161.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-21T01:48:44.005Z",
      "x_nadsec_last_seen": "2026-05-21T07:36:48.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "18233"
      ],
      "x_nadsec_orgs": [
        "Philippine Telegraph and Telephone Corporation"
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--aa3e15ef-f535-4534-b463-c8804999ffdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.9.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T01:11:22.730Z",
      "x_nadsec_last_seen": "2026-05-21T01:11:26.089Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-21T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--5b57d99f-3a63-4cc7-9630-6036118b6630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.180.50.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:05:14.000Z",
      "valid_until": "2026-06-22T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T01:44:38.435Z",
      "x_nadsec_last_seen": "2026-05-21T01:46:45.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ea9e99a0-41ef-442c-8547-ed83206f7012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.139.63.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T02:46:47.099Z",
      "x_nadsec_last_seen": "2026-05-21T02:48:52.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c7182fd5-feba-4785-b44d-6fb52630f93f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.37.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T02:05:51.547Z",
      "x_nadsec_last_seen": "2026-05-21T02:05:51.547Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3d3252e4-26e8-4999-a79c-8eeae2d7e5d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.81.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-21T02:11:09.736Z",
      "x_nadsec_last_seen": "2026-05-21T02:32:04.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7bd5b43f-2d8f-43f6-8096-64a57429ecab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.21.179.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T02:05:47.645Z",
      "x_nadsec_last_seen": "2026-05-21T02:05:52.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--837d37c2-cd06-47fa-85af-9a7c585fad93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.163.79.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T02:36:58.826Z",
      "x_nadsec_last_seen": "2026-05-21T02:39:18.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--12d5dc22-3f6e-44a0-8f33-5fa46e1c58a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.215.134.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T02:12:54.344Z",
      "x_nadsec_last_seen": "2026-05-22T12:53:53.221Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--ed48f483-8b72-4c01-8099-8f201fe9dd5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.110.202.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T02:30:54.963Z",
      "x_nadsec_last_seen": "2026-05-21T02:33:01.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1099; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--1862bae2-bfdd-45cf-b534-7de5e983a07c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.250.14.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 1099,
      "x_nadsec_first_seen": "2026-05-21T02:18:53.058Z",
      "x_nadsec_last_seen": "2026-05-21T02:35:13.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--d81aee51-0bdd-4ca1-a989-9922c9117eec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.120.250.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T02:42:36.137Z",
      "x_nadsec_last_seen": "2026-05-21T02:49:22.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=23487; asn_org=CONECEL",
      "id": "indicator--3adf30fb-1953-45f5-b9f1-fe9417d41ac3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.63.121.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T02:07:52.292Z",
      "x_nadsec_last_seen": "2026-05-21T02:09:59.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "23487"
      ],
      "x_nadsec_orgs": [
        "CONECEL"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--32b2a351-3a7e-4a39-a050-bc793a261373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.71.125.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T02:28:46.371Z",
      "x_nadsec_last_seen": "2026-05-21T02:30:55.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--608d18f0-c115-47d9-9165-48f6cd28e2d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.99.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T02:08:33.091Z",
      "x_nadsec_last_seen": "2026-05-21T02:08:33.091Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5fcaef20-9988-4f9b-8d8f-388de2c21a99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.233.61.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T02:09:51.334Z",
      "x_nadsec_last_seen": "2026-05-21T02:10:46.801Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--22356e87-9e20-4db9-9cfb-3f9e24b4fcf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.48.114.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T02:16:07.409Z",
      "x_nadsec_last_seen": "2026-05-21T02:23:02.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--614e381f-ddae-4fda-a185-74ff1d965e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T03:05:10.000Z",
      "valid_until": "2026-06-22T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T02:09:29.705Z",
      "x_nadsec_last_seen": "2026-05-21T02:09:29.705Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--fdbb9cce-74bb-49c3-9a32-20335ab3fd8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.155.204.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-21T03:54:11.382Z",
      "x_nadsec_last_seen": "2026-05-30T09:08:21.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--85eac18e-7dc8-4c1b-819d-e2e7c17402b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.162.208.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T03:57:56.892Z",
      "x_nadsec_last_seen": "2026-05-21T04:00:01.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--460124fe-f37d-44b1-be51-b3cb8b28dd9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.171.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-21T03:26:31.119Z",
      "x_nadsec_last_seen": "2026-05-21T03:47:10.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=pptpd; ports=1723; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--10a7fd5d-b821-4f1a-8181-a28412f28da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.169.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-21T03:43:10.750Z",
      "x_nadsec_last_seen": "2026-05-21T03:43:32.367Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.46.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-21T03:47:28.215Z",
      "x_nadsec_last_seen": "2026-05-21T03:48:09.244Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--f06ec988-b8a2-491c-b445-c818eeeab1af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.113.54.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T03:42:54.363Z",
      "x_nadsec_last_seen": "2026-05-21T03:45:00.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--d5ff9dea-9a1c-4aa1-ad89-797229ce90ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.200.81.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T03:11:54.174Z",
      "x_nadsec_last_seen": "2026-05-21T03:18:24.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-21T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--fd169adf-59ad-4024-8405-388ab4ea41e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.111.193.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T04:05:10.000Z",
      "valid_until": "2026-06-22T04:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-21T03:40:45.501Z",
      "x_nadsec_last_seen": "2026-05-30T16:46:03.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=131442; asn_org=Digital Network Associates Pvt Ltd; user(top)=**",
      "id": "indicator--1f9e88fd-14dc-43cc-842e-ab4cfe79d1a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.245.71.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T04:39:48.345Z",
      "x_nadsec_last_seen": "2026-05-21T04:39:48.345Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131442"
      ],
      "x_nadsec_orgs": [
        "Digital Network Associates Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8b439573-64f5-4a6f-8f6a-b0814764f70d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.162.195.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T04:16:14.211Z",
      "x_nadsec_last_seen": "2026-05-21T04:18:18.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T04:47:20.740Z",
      "x_nadsec_last_seen": "2026-05-21T04:47:20.740Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e67682d2-6dba-4cbf-8941-ef3f93c04c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.21.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-21T04:25:05.592Z",
      "x_nadsec_last_seen": "2026-05-21T05:10:37.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--28c01199-82df-4d05-ae89-1ebd244ad9dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.7.57.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T04:23:16.434Z",
      "x_nadsec_last_seen": "2026-05-21T04:25:20.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--15d05585-a95f-4d3a-a71b-aef1013ec9a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T05:02:35.714Z",
      "x_nadsec_last_seen": "2026-05-21T05:02:45.888Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--27b4d742-7e08-41bf-8c4d-8e0db7f42ee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T04:53:09.724Z",
      "x_nadsec_last_seen": "2026-05-21T04:53:09.724Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--90f9857e-da2b-426b-a844-4a76a0edab03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T04:53:09.339Z",
      "x_nadsec_last_seen": "2026-05-21T04:53:09.339Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--19a4f6ec-c2d7-4e97-8cfe-806b2ae28adb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.244.17.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T04:55:20.862Z",
      "x_nadsec_last_seen": "2026-05-21T04:55:20.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--0b86ba45-5e18-448e-83bd-a8e159dcce6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.97.204.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-21T04:06:01.407Z",
      "x_nadsec_last_seen": "2026-05-21T06:13:21.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-21T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--7f61ca04-af93-43e5-8c03-29a2f7825d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:05:10.000Z",
      "valid_until": "2026-06-22T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T04:48:33.498Z",
      "x_nadsec_last_seen": "2026-05-21T04:48:33.498Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=147171; asn_org=Badan Riset dan Inovasi Nasional",
      "id": "indicator--50b7233b-27d4-4b38-8d0c-40ac8f6a7328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.178.218.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-21T05:43:38.443Z",
      "x_nadsec_last_seen": "2026-05-21T08:11:08.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "147171"
      ],
      "x_nadsec_orgs": [
        "Badan Riset dan Inovasi Nasional"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--23a0c8ac-35f4-4fe2-abef-271bb030534d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.4.94.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T05:41:28.478Z",
      "x_nadsec_last_seen": "2026-05-21T05:43:34.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--e1e53599-d52d-4218-84c4-c96f1edc6a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.27.226.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T05:45:21.317Z",
      "x_nadsec_last_seen": "2026-05-21T05:47:25.967Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--048e6b43-256c-45ec-8b04-6c31b4257e72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T05:58:22.841Z",
      "x_nadsec_last_seen": "2026-05-21T05:58:33.028Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--e401ea77-f12f-411f-8d88-e04708e6d9e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.195.33.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T05:51:27.617Z",
      "x_nadsec_last_seen": "2026-05-21T05:53:33.597Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--d32d56a3-8a6e-47fe-8af7-6e4b9127d785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.26.90.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T05:59:03.784Z",
      "x_nadsec_last_seen": "2026-05-21T06:01:10.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=9381; asn_org=HKBN Enterprise Solutions HK Limited",
      "id": "indicator--e6fe80de-2109-4040-a2f3-d5656a419f90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.126.220.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T05:10:30.001Z",
      "x_nadsec_last_seen": "2026-05-21T05:12:34.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9381"
      ],
      "x_nadsec_orgs": [
        "HKBN Enterprise Solutions HK Limited"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6fbce0dc-5057-4abb-ac0c-7dfe69e33eea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.232.41.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T05:38:55.301Z",
      "x_nadsec_last_seen": "2026-05-21T05:41:00.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UA; asn=6849; asn_org=JSC Ukrtelecom",
      "id": "indicator--2f3d1bd0-e306-4d7a-9f4a-db76b6607d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.200.89.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T05:16:08.727Z",
      "x_nadsec_last_seen": "2026-05-26T11:27:41.582Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6849"
      ],
      "x_nadsec_orgs": [
        "JSC Ukrtelecom"
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1158; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--b61ed9bf-28e8-45eb-9394-5179ca5b0fbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.131.239.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-05-21T05:44:26.970Z",
      "x_nadsec_last_seen": "2026-05-21T06:36:47.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-05-21T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=31725; asn_org=ISP Shtorm LTD",
      "id": "indicator--f323b0e1-6385-4542-b245-fa9bbde63c74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.201.244.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T06:05:10.000Z",
      "valid_until": "2026-06-22T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T05:10:13.434Z",
      "x_nadsec_last_seen": "2026-05-26T11:27:40.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "31725"
      ],
      "x_nadsec_orgs": [
        "ISP Shtorm LTD"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--1dab3f0c-bdaa-47f1-ba33-f59e53ac3be6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.20.253.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T06:35:18.733Z",
      "x_nadsec_last_seen": "2026-05-21T06:37:24.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=132445; asn_org=Khetan Cable Network Pvt. Limited",
      "id": "indicator--6f3f7680-e0fc-4ff3-a4de-d7f5443298d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.166.143.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T06:23:40.779Z",
      "x_nadsec_last_seen": "2026-05-21T06:31:11.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132445"
      ],
      "x_nadsec_orgs": [
        "Khetan Cable Network Pvt. Limited"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--319e5b04-20d8-4e4a-9a26-23159991119f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.248.172.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T06:45:22.635Z",
      "x_nadsec_last_seen": "2026-05-21T06:45:24.551Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--9c9cf4c4-8d48-4c96-bfd6-375a8d1a089c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.239.218.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T07:00:01.488Z",
      "x_nadsec_last_seen": "2026-05-21T07:02:07.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--7f4c76b9-34bb-488b-8f14-72a102c8cb25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.69.61.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T06:23:12.650Z",
      "x_nadsec_last_seen": "2026-05-21T06:25:18.743Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--91892da3-3027-433f-bda3-8561b2e8b0d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.187.186.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T06:42:23.645Z",
      "x_nadsec_last_seen": "2026-05-21T06:48:49.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7d58ce99-ecc5-4aa2-b21f-971bd5df3a16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.182.34.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T07:04:00.921Z",
      "x_nadsec_last_seen": "2026-05-21T07:04:01.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--adaf6a27-ece9-4f2a-bf64-31c6eac3501f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.186.246.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T06:38:13.493Z",
      "x_nadsec_last_seen": "2026-05-21T06:40:21.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=6849; asn_org=JSC Ukrtelecom",
      "id": "indicator--2296bb63-4b69-471b-bb78-5c201216bea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.5.15.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T06:26:33.261Z",
      "x_nadsec_last_seen": "2026-05-21T06:28:39.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6849"
      ],
      "x_nadsec_orgs": [
        "JSC Ukrtelecom"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KH; asn=38600; asn_org=SMART AXIATA Co., Ltd.",
      "id": "indicator--697cce24-05ba-4e07-aa81-4993024d0623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.56.3.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T06:06:25.580Z",
      "x_nadsec_last_seen": "2026-05-21T06:06:25.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38600"
      ],
      "x_nadsec_orgs": [
        "SMART AXIATA Co., Ltd."
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=154265; asn_org=PT Andalan Media Raya",
      "id": "indicator--62332ade-d941-45af-8556-7c1abcdc4508",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.34.125.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T07:02:44.082Z",
      "x_nadsec_last_seen": "2026-05-21T07:04:48.309Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "154265"
      ],
      "x_nadsec_orgs": [
        "PT Andalan Media Raya"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b6ea4235-db60-46d7-8270-18a44ee18e4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.38.155.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T06:14:09.855Z",
      "x_nadsec_last_seen": "2026-05-21T06:14:09.855Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--64b65b9a-4255-444b-92ce-7b12ea16561b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.205.162.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T07:04:40.423Z",
      "x_nadsec_last_seen": "2026-05-27T09:05:19.682Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d4899af5-c4db-4b00-9366-b619fedf719f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.91.151.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-21T06:58:34.705Z",
      "x_nadsec_last_seen": "2026-05-21T07:12:42.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a065ef79-cee4-465c-a186-ea8e64e8178c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.171.96.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T06:24:21.537Z",
      "x_nadsec_last_seen": "2026-05-21T06:25:43.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--5a8a78e7-0036-44a8-aff3-6c606256a2d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T06:15:43.486Z",
      "x_nadsec_last_seen": "2026-05-21T06:15:43.486Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-21T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1ec6b7d2-2287-4f2e-9166-a8e2505353b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.188.82.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:05:10.000Z",
      "valid_until": "2026-06-22T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T06:12:54.579Z",
      "x_nadsec_last_seen": "2026-05-21T06:15:02.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--0b080684-3919-44ec-9e5a-561c31da0e2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.2.229.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T07:07:59.018Z",
      "x_nadsec_last_seen": "2026-05-21T07:10:03.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IT; asn=30722; asn_org=Fastweb; user(top)=**",
      "id": "indicator--434b4373-35ea-4397-a287-24b08f1fc4df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.117.222.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T07:42:28.002Z",
      "x_nadsec_last_seen": "2026-05-21T07:42:28.002Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3ba1542a-9f66-47f4-84da-433ee7116459",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.187.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T07:51:44.673Z",
      "x_nadsec_last_seen": "2026-05-21T07:53:50.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--962fa6e7-26ba-41c2-9a42-4845372e2fb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.45.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-21T07:35:43.010Z",
      "x_nadsec_last_seen": "2026-05-27T10:57:26.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--efd14145-1d95-4bb3-9506-9a07544713d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.153.82.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-21T07:50:13.851Z",
      "x_nadsec_last_seen": "2026-05-21T09:26:15.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--fb3849ca-a5d0-4997-af47-da2b9e933d8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.179.254.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T07:39:49.781Z",
      "x_nadsec_last_seen": "2026-05-21T07:41:56.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--13de0dd0-02e9-4386-b30f-3d37efd8dc84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T07:37:14.630Z",
      "x_nadsec_last_seen": "2026-05-21T07:37:14.630Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--ea9eb1e9-21f5-4c42-8771-b2929cd34616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.178.215.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T07:15:34.409Z",
      "x_nadsec_last_seen": "2026-05-21T07:15:39.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-21T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=272854; asn_org=TELECOMUNICACIONES SILVERDATA, C.A.",
      "id": "indicator--d41be145-759e-43fc-9fb6-a4331a5c2dd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.195.12.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:05:11.000Z",
      "valid_until": "2026-06-22T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T07:44:15.904Z",
      "x_nadsec_last_seen": "2026-05-21T07:46:22.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "272854"
      ],
      "x_nadsec_orgs": [
        "TELECOMUNICACIONES SILVERDATA, C.A."
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=132925; asn_org=Ideastack Solutions Private Limited",
      "id": "indicator--34e30848-e225-46b2-90be-87db3a56e3ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.135.121.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T08:56:44.894Z",
      "x_nadsec_last_seen": "2026-05-21T08:56:45.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132925"
      ],
      "x_nadsec_orgs": [
        "Ideastack Solutions Private Limited"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--95cc05ad-b2ff-4ff5-8cd7-1911dac7ec46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.155.223.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T09:02:27.150Z",
      "x_nadsec_last_seen": "2026-05-21T09:04:33.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f0fb0e83-aba9-4743-b3b5-1331033817f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.161.51.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T08:33:23.178Z",
      "x_nadsec_last_seen": "2026-05-21T08:35:27.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4f4aa5b7-fe72-46dd-97e5-c8f52d233ee7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.30.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T08:56:21.964Z",
      "x_nadsec_last_seen": "2026-05-21T08:56:21.964Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--f530fd5f-86d3-4d2a-9e3c-370a3dc340bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.236.155.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T08:56:18.964Z",
      "x_nadsec_last_seen": "2026-05-21T08:58:24.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b3ff0e1e-2ab7-46b4-a3ec-b710ba3b3916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T08:45:36.057Z",
      "x_nadsec_last_seen": "2026-05-21T08:45:36.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--d5bdd07a-642c-40d5-9d1f-ce4cac3b2c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.247.157.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T08:36:56.192Z",
      "x_nadsec_last_seen": "2026-05-21T08:37:00.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--a1cd9545-18cc-49c0-9458-78a2999c4f63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.83.196.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T08:24:04.215Z",
      "x_nadsec_last_seen": "2026-05-21T08:30:42.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=9484; asn_org=Mobinet LLC. AS Mobinet Internet Service Provider",
      "id": "indicator--48f22886-afcb-413e-9a82-5d7b3c9388f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.131.233.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T08:09:39.681Z",
      "x_nadsec_last_seen": "2026-05-21T08:09:47.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "9484"
      ],
      "x_nadsec_orgs": [
        "Mobinet LLC. AS Mobinet Internet Service Provider"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9927; asn_org=Philippine Global Communications Corporation",
      "id": "indicator--c7506e36-4cb6-4e39-bef1-2fdbc5c30141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.57.41.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T08:34:24.718Z",
      "x_nadsec_last_seen": "2026-05-21T08:41:31.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9927"
      ],
      "x_nadsec_orgs": [
        "Philippine Global Communications Corporation"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--f3dccb34-9b77-42f6-938d-0e9e791c928f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.205.34.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T08:18:38.633Z",
      "x_nadsec_last_seen": "2026-05-21T08:20:43.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31430; asn_org=OOO Suntel",
      "id": "indicator--e59616e4-73bd-45dd-bd9d-e1b2203426b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.147.21.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T08:14:42.625Z",
      "x_nadsec_last_seen": "2026-05-21T08:14:49.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31430"
      ],
      "x_nadsec_orgs": [
        "OOO Suntel"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--7d50b12b-2bb4-4eb8-88ab-1973174a3b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.130.187.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T08:55:18.196Z",
      "x_nadsec_last_seen": "2026-05-21T08:55:18.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--9fe054b1-7d2a-4929-a976-1078547377c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.76.112.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T08:49:47.993Z",
      "x_nadsec_last_seen": "2026-05-21T08:54:15.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cffd0254-b4bb-4e8b-b9a1-67623793f62b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '4.213.169.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T08:55:26.190Z",
      "x_nadsec_last_seen": "2026-05-23T04:29:11.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=8452; asn_org=TE Data; user(top)=**",
      "id": "indicator--259477e9-c9d1-4c7a-a8d1-7076a217ff38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.31.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T08:56:59.067Z",
      "x_nadsec_last_seen": "2026-05-21T08:56:59.067Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=JO; asn=35656; asn_org=Jordanian Universities Network L.L.C.",
      "id": "indicator--4b99b7d6-76a2-4c1b-8bac-dba13d4af89c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.232.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T09:00:33.284Z",
      "x_nadsec_last_seen": "2026-05-21T09:07:40.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "35656"
      ],
      "x_nadsec_orgs": [
        "Jordanian Universities Network L.L.C."
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6a11f28e-2040-4f7a-93a5-74cae9919f46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T08:33:54.970Z",
      "x_nadsec_last_seen": "2026-05-21T08:33:54.970Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8497153e-fc07-46ac-8e15-89475a49d568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T08:34:27.214Z",
      "x_nadsec_last_seen": "2026-05-21T08:34:27.214Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--96913820-ac0c-498c-affe-28b4727305e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:05:10.000Z",
      "valid_until": "2026-06-22T09:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T08:33:55.068Z",
      "x_nadsec_last_seen": "2026-05-21T08:34:27.022Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--4092b0ff-fc96-42d8-a706-18942756e247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.96.102.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T09:31:48.403Z",
      "x_nadsec_last_seen": "2026-05-21T09:33:56.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--3c5dd6f4-4c74-46c9-bc8c-f9fb25f246e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.176.104.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-05-21T09:49:45.655Z",
      "x_nadsec_last_seen": "2026-05-21T10:54:29.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e2dcaf49-0295-4f1d-92a6-d99cb97279ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.134.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T09:32:34.242Z",
      "x_nadsec_last_seen": "2026-05-21T09:34:39.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31208; asn_org=PJSC MegaFon",
      "id": "indicator--7442f671-5c12-454d-a52b-59e1501f22d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.176.59.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T09:22:39.935Z",
      "x_nadsec_last_seen": "2026-05-21T09:23:49.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31208"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--26a250ec-aa8f-4775-854d-20d0b3716056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.103.117.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T09:44:57.821Z",
      "x_nadsec_last_seen": "2026-05-29T11:07:21.671Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--136457b1-50fc-4b77-880b-eaa0846ac949",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.93.183.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T09:16:02.040Z",
      "x_nadsec_last_seen": "2026-05-21T09:16:02.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50187; asn_org=BaikalWestCom",
      "id": "indicator--c8896f87-5745-457d-9ad1-ae5718fee0c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.67.31.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T09:48:42.337Z",
      "x_nadsec_last_seen": "2026-05-21T09:50:26.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50187"
      ],
      "x_nadsec_orgs": [
        "BaikalWestCom"
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T09:31:49.324Z",
      "x_nadsec_last_seen": "2026-05-21T09:31:49.324Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--badfcc20-f8f6-47e6-b510-ea78dd46c651",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T09:43:53.690Z",
      "x_nadsec_last_seen": "2026-05-21T09:43:53.690Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-21T10:05:39.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--032578bc-df4e-45c3-a403-f8d0882bee16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T10:05:39.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.37.28.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T10:05:39.000Z",
      "valid_until": "2026-06-22T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T09:56:20.558Z",
      "x_nadsec_last_seen": "2026-05-21T09:56:27.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--f585fe04-618d-46f8-a7f9-908f4ab968af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.33.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T12:56:44.824Z",
      "x_nadsec_last_seen": "2026-05-21T12:58:54.363Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--9893d19c-eec8-458c-9047-a7ca9e5238e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.52.112.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T12:17:11.706Z",
      "x_nadsec_last_seen": "2026-05-21T12:23:41.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=263432; asn_org=CORPORATIVA TELECOMUNICACOES EIRELI ME",
      "id": "indicator--1d3a29f8-2439-4663-b339-9ad424a89afe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.91.77.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-21T12:54:47.843Z",
      "x_nadsec_last_seen": "2026-05-21T15:07:49.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263432"
      ],
      "x_nadsec_orgs": [
        "CORPORATIVA TELECOMUNICACOES EIRELI ME"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--60b03484-0d05-40e7-b252-8d13c3e2194e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.98.180.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T12:04:45.272Z",
      "x_nadsec_last_seen": "2026-05-21T12:08:38.805Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=215929; asn_org=Data Campus Limited",
      "id": "indicator--1bab34f9-646c-4fe0-ae7d-9a1afa441596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.24.211.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T13:02:47.487Z",
      "x_nadsec_last_seen": "2026-05-24T04:25:20.658Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "215929"
      ],
      "x_nadsec_orgs": [
        "Data Campus Limited"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fc28fe2b-d38a-4bb3-ab88-d2bf58caaf00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.12.240.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T13:01:58.639Z",
      "x_nadsec_last_seen": "2026-05-21T13:01:59.343Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--1181c61b-a799-4650-bcfc-07dd5f3b1d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.72.244.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T12:58:19.945Z",
      "x_nadsec_last_seen": "2026-05-21T13:00:25.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=43865; asn_org=Intek-M LLC",
      "id": "indicator--12269ea2-f5e2-4c0b-98a6-a6aa70453f3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.135.91.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T12:06:09.490Z",
      "x_nadsec_last_seen": "2026-05-21T12:08:15.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43865"
      ],
      "x_nadsec_orgs": [
        "Intek-M LLC"
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269820; asn_org=FULL DATA COMUNICACIONES C.A.",
      "id": "indicator--4a92093a-d10f-45e7-b7b4-cc83c58c8fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.43.222.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T12:35:03.321Z",
      "x_nadsec_last_seen": "2026-05-21T12:37:09.961Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269820"
      ],
      "x_nadsec_orgs": [
        "FULL DATA COMUNICACIONES C.A."
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=132923; asn_org=Vihaan Telecommunication Pvt. Ltd.",
      "id": "indicator--b6abd03a-c856-4670-86b2-62a0bb0dd04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.228.229.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T12:14:56.964Z",
      "x_nadsec_last_seen": "2026-05-21T12:21:22.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132923"
      ],
      "x_nadsec_orgs": [
        "Vihaan Telecommunication Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-21T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T13:05:02.000Z",
      "valid_until": "2026-06-22T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T12:54:58.168Z",
      "x_nadsec_last_seen": "2026-05-21T12:54:58.168Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-21T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--8e7c50b0-5e74-4ef2-bd9e-ffef4dc44ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.176.78.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:05:14.000Z",
      "valid_until": "2026-06-22T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T14:32:28.933Z",
      "x_nadsec_last_seen": "2026-05-21T14:32:34.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-21T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--4f5b00c3-dcc4-442b-8354-178a0e99d384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.181.22.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:05:14.000Z",
      "valid_until": "2026-06-22T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T14:33:58.982Z",
      "x_nadsec_last_seen": "2026-05-21T14:35:07.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-05-21T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--6a2ad340-a226-4286-a82f-51ca31012993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.69.103.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:05:14.000Z",
      "valid_until": "2026-06-22T15:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-21T14:46:30.518Z",
      "x_nadsec_last_seen": "2026-05-24T13:36:35.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-05-21T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a748fb2a-4226-454d-8aea-26864112328c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.23.161.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:05:14.000Z",
      "valid_until": "2026-06-22T15:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-21T14:17:02.564Z",
      "x_nadsec_last_seen": "2026-05-21T15:55:11.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-21T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=134762; asn_org=CHINANET Liaoning province Dalian MAN network",
      "id": "indicator--e5ea6ef0-39f8-476e-a6ec-2ea2c90d47d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.46.195.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:05:14.000Z",
      "valid_until": "2026-06-22T15:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-21T15:03:27.635Z",
      "x_nadsec_last_seen": "2026-05-21T15:03:43.381Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134762"
      ],
      "x_nadsec_orgs": [
        "CHINANET Liaoning province Dalian MAN network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-05-21T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--764533de-8194-4ac9-8562-5d6d24957128",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T15:05:14.000Z",
      "valid_until": "2026-06-22T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T14:48:06.838Z",
      "x_nadsec_last_seen": "2026-05-21T14:50:14.456Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--010595ec-6830-4d76-8b4c-0b40d9ffad7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.10.85.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T15:42:29.610Z",
      "x_nadsec_last_seen": "2026-05-21T15:44:37.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--50edacc2-8b85-4f62-b361-3a27c801e03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.203.9.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T15:34:59.065Z",
      "x_nadsec_last_seen": "2026-05-21T15:34:59.065Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--51dda3dc-d400-4962-81d0-af9560917347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.45.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T15:55:52.946Z",
      "x_nadsec_last_seen": "2026-05-21T16:02:55.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--bd2b535f-30c6-44c9-8cf2-de2c99b7a20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.42.213.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-21T15:31:32.741Z",
      "x_nadsec_last_seen": "2026-05-21T17:51:36.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T15:12:39.274Z",
      "x_nadsec_last_seen": "2026-05-21T15:12:39.274Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--b83a3310-e5fa-4462-ae74-2625d1d3fa54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.14.238.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-21T15:35:45.628Z",
      "x_nadsec_last_seen": "2026-05-27T04:45:02.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28775; asn_org=Ooo Transtelecom",
      "id": "indicator--bd6ce9eb-c453-4473-95ae-ccd4b86a3e30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.21.210.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T15:52:20.000Z",
      "x_nadsec_last_seen": "2026-05-21T15:54:27.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28775"
      ],
      "x_nadsec_orgs": [
        "Ooo Transtelecom"
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--63f5f1b3-34c7-4343-bae8-e3ead63eb766",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.177.223.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T15:41:04.712Z",
      "x_nadsec_last_seen": "2026-05-21T15:41:04.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e2aaddb3-bf86-43a2-a2a8-e38841436f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.210.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T15:09:12.606Z",
      "x_nadsec_last_seen": "2026-05-21T15:09:12.606Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--dd92c321-4615-4bda-bd0a-301a8573c4ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.172.120.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T15:34:01.472Z",
      "x_nadsec_last_seen": "2026-05-21T15:34:01.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-21T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--b42d4b38-2402-4219-a47e-4a77d997782d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.99.235.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:05:10.000Z",
      "valid_until": "2026-06-22T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T15:47:31.094Z",
      "x_nadsec_last_seen": "2026-05-21T15:49:37.650Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-21T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--e8d2c6fb-9b59-407c-bd9f-6104a6dd31f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.206.255.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:05:06.000Z",
      "valid_until": "2026-06-22T17:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T16:18:40.395Z",
      "x_nadsec_last_seen": "2026-05-21T16:19:29.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-05-21T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e2c18689-19d2-4ea4-828d-6851bb86b4e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.20.237.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:05:06.000Z",
      "valid_until": "2026-06-22T17:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T16:33:33.845Z",
      "x_nadsec_last_seen": "2026-05-21T16:37:49.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-21T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--38f0ccad-a114-48ac-ab44-539610f0eea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:05:06.000Z",
      "valid_until": "2026-06-22T17:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T16:14:08.426Z",
      "x_nadsec_last_seen": "2026-05-21T16:14:08.426Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--a00b3404-6a50-40b4-bd4b-17eeb2f169b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.47.144.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:05:06.000Z",
      "valid_until": "2026-06-22T17:05:04.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-21T16:46:51.495Z",
      "x_nadsec_last_seen": "2026-05-21T19:03:26.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-21T17:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--18ad3ff0-b49a-4d15-bc40-ec745ce9a750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T17:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.48.231.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T17:05:06.000Z",
      "valid_until": "2026-06-22T17:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T16:32:34.554Z",
      "x_nadsec_last_seen": "2026-05-21T16:34:39.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-21T18:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0d6ebc25-9c32-42b6-b46d-39c665f485ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.189.243.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:05:06.000Z",
      "valid_until": "2026-06-22T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T17:55:09.162Z",
      "x_nadsec_last_seen": "2026-05-21T17:57:14.582Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T18:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--364ee670-1aa6-4ccd-81e5-ceef27114c46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.95.23.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:05:06.000Z",
      "valid_until": "2026-06-22T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T17:58:32.422Z",
      "x_nadsec_last_seen": "2026-05-21T17:58:32.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-21T18:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=22; services=mongod; ports=27017; cc=DE; asn=24940; asn_org=Hetzner Online GmbH",
      "id": "indicator--e3ea0328-cbf2-4e81-8865-a70324bf19ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.168.204.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:05:06.000Z",
      "valid_until": "2026-06-22T18:05:03.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-05-21T17:17:01.037Z",
      "x_nadsec_last_seen": "2026-05-21T17:26:09.613Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "24940"
      ],
      "x_nadsec_orgs": [
        "Hetzner Online GmbH"
      ]
    },
    {
      "created": "2026-05-21T18:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--5d51e596-0068-4235-8ac8-986a44f32478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.183.10.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:05:06.000Z",
      "valid_until": "2026-06-22T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T17:06:48.238Z",
      "x_nadsec_last_seen": "2026-05-21T17:08:53.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-05-21T18:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--3e201a0f-dd4f-4df7-b4df-f1f799d5893d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.114.215.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:05:06.000Z",
      "valid_until": "2026-06-22T18:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T17:53:19.252Z",
      "x_nadsec_last_seen": "2026-05-21T18:00:26.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-21T18:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T18:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:05:06.000Z",
      "valid_until": "2026-06-22T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T17:33:24.274Z",
      "x_nadsec_last_seen": "2026-05-21T17:33:24.274Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3b48d475-cbc8-4971-a586-acb2b4ae0cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.36.114.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T18:09:19.316Z",
      "x_nadsec_last_seen": "2026-05-21T18:09:48.480Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--85283f52-8700-41c6-b787-4191987eec43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.81.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T19:04:08.541Z",
      "x_nadsec_last_seen": "2026-05-21T19:06:16.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--47b41402-de3d-4945-ab96-0c2479621170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T19:01:21.776Z",
      "x_nadsec_last_seen": "2026-05-21T19:01:21.776Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d884b05e-c82e-4ef4-ac6e-8e6f6ff88f44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.207.44.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T18:51:50.068Z",
      "x_nadsec_last_seen": "2026-05-21T18:51:52.009Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T18:25:25.738Z",
      "x_nadsec_last_seen": "2026-05-23T15:04:21.621Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=ID; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f89f61d1-3222-4314-9dce-643cd598b89a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.150.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T18:21:08.158Z",
      "x_nadsec_last_seen": "2026-05-21T18:21:34.953Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--36ebf076-36e4-43e6-9459-14a2b358867b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T18:52:29.886Z",
      "x_nadsec_last_seen": "2026-05-21T18:52:50.422Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--644c36bd-05e4-4555-8c93-862d69f379f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.45.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T18:08:55.523Z",
      "x_nadsec_last_seen": "2026-05-21T18:11:02.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=5429; asn_org=Telecommunications center UMOS, LLC",
      "id": "indicator--d4c2c130-6c9e-4765-ad65-b4339d3209b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.178.205.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T18:17:26.182Z",
      "x_nadsec_last_seen": "2026-05-21T18:21:11.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "5429"
      ],
      "x_nadsec_orgs": [
        "Telecommunications center UMOS, LLC"
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=RU; asn=34665; asn_org=Petersburg Internet Network ltd.",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T18:34:47.697Z",
      "x_nadsec_last_seen": "2026-05-29T13:08:20.400Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34665"
      ],
      "x_nadsec_orgs": [
        "Petersburg Internet Network ltd."
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9d4d3268-8865-48d7-a841-d9ad7baeeae8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T18:06:43.911Z",
      "x_nadsec_last_seen": "2026-05-21T18:06:43.911Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--99cc663e-1d02-4987-89b1-db98b61e0a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T19:05:10.000Z",
      "valid_until": "2026-06-22T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T18:06:33.706Z",
      "x_nadsec_last_seen": "2026-05-21T18:06:33.706Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--39b86dc8-cc86-4e2a-9294-80f44cc6905c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.130.208.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T20:54:20.739Z",
      "x_nadsec_last_seen": "2026-05-21T20:54:20.739Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24088"
      ],
      "x_nadsec_orgs": [
        "Hanoi Telecom Joint Stock Company - HCMC Branch"
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--ba980708-aefb-47d1-a1a0-200a051a2376",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.119.254.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T20:11:12.340Z",
      "x_nadsec_last_seen": "2026-05-21T20:11:13.707Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f6fd302f-85ed-46d0-848f-5cb273c84d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.248.82.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T20:52:16.074Z",
      "x_nadsec_last_seen": "2026-05-21T20:54:19.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2941c7e9-6756-45d7-93bf-c6b05ec74e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.141.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T20:23:03.501Z",
      "x_nadsec_last_seen": "2026-05-21T20:23:33.435Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d957e995-1d2f-4ee3-90e7-51a04477eabf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.107.232.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T20:53:29.349Z",
      "x_nadsec_last_seen": "2026-05-21T20:55:35.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--11f89c53-590a-48cb-a8ff-11615816e110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T20:46:41.032Z",
      "x_nadsec_last_seen": "2026-05-25T16:50:53.186Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=197450; asn_org=Sunucun Bilgi Iletisim Teknolojileri ve Ticaret Ltd. Sti.",
      "id": "indicator--c380e818-9fea-439e-873d-610dffa9fea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.64.201.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T20:43:42.039Z",
      "x_nadsec_last_seen": "2026-05-21T20:43:42.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "197450"
      ],
      "x_nadsec_orgs": [
        "Sunucun Bilgi Iletisim Teknolojileri ve Ticaret Ltd. Sti."
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--cb17b7a8-9480-4948-9d0e-cd1b26976c8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.33.158.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 3108,
      "x_nadsec_first_seen": "2026-05-21T20:09:33.434Z",
      "x_nadsec_last_seen": "2026-05-25T10:33:16.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-21T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom; user(top)=**",
      "id": "indicator--45e636d5-1e8b-4cf0-acc5-3838a673a261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.200.154.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T21:05:12.000Z",
      "valid_until": "2026-06-22T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T20:07:55.836Z",
      "x_nadsec_last_seen": "2026-05-21T20:07:55.836Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8506fabc-c4d9-43dc-ab0c-8a8ce2dfb643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T21:44:39.916Z",
      "x_nadsec_last_seen": "2026-05-21T21:44:39.916Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--0a67906f-a845-4767-a710-2aa9c28098b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.197.0.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T21:23:00.227Z",
      "x_nadsec_last_seen": "2026-05-21T21:23:00.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=MX; asn=18734; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--f273f529-72af-4e8b-8625-319553176656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.204.171.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-21T21:08:32.199Z",
      "x_nadsec_last_seen": "2026-05-21T21:13:22.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "18734"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--eb2af5a9-30ae-4832-addf-365f767d41cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.243.160.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-21T21:36:07.839Z",
      "x_nadsec_last_seen": "2026-05-28T19:16:55.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a6049f24-8650-4273-9511-0542ebef210c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T21:46:57.199Z",
      "x_nadsec_last_seen": "2026-05-21T21:46:57.199Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=NG; asn=20598; asn_org=CYBERSPACE-AS Autonomous System number for Cyber Space; user(top)=**",
      "id": "indicator--8489dfb5-e65e-4dc5-903b-d53a59ccdd91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.100.67.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T21:27:37.548Z",
      "x_nadsec_last_seen": "2026-05-21T21:27:38.933Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "20598"
      ],
      "x_nadsec_orgs": [
        "CYBERSPACE-AS Autonomous System number for Cyber Space"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e9d822bd-a9ae-4131-ac3e-f690b81b22de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.91.108.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T21:09:21.931Z",
      "x_nadsec_last_seen": "2026-05-21T21:11:26.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-21T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:05:10.000Z",
      "valid_until": "2026-06-22T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T21:33:30.358Z",
      "x_nadsec_last_seen": "2026-05-21T21:33:30.358Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--da78b1c3-24c7-4fe6-a46b-438cbf8d6911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.36.106.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T22:08:17.747Z",
      "x_nadsec_last_seen": "2026-05-21T22:08:17.747Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7eef1813-7e33-4073-b7f5-fef93cc39ed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.176.195.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T22:10:45.401Z",
      "x_nadsec_last_seen": "2026-05-21T22:17:15.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5b67a3e7-22a5-4016-9d35-b914eb9f17a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.163.73.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T22:28:25.215Z",
      "x_nadsec_last_seen": "2026-05-21T22:34:59.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--605de8e5-0fb8-4735-816e-9bfb7fb444ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.177.62.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T22:23:07.453Z",
      "x_nadsec_last_seen": "2026-05-21T22:25:12.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UZ; asn=8193; asn_org=Uzbektelekom Joint Stock Company",
      "id": "indicator--5ea0aaaf-db4d-4246-b4e6-41de1024e662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.158.27.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-21T22:49:22.628Z",
      "x_nadsec_last_seen": "2026-05-25T09:57:12.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "8193"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=12998; asn_org=BGNet LLC",
      "id": "indicator--1877aa05-460c-447d-b9a1-5ba66c617929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.3.159.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-21T22:06:21.174Z",
      "x_nadsec_last_seen": "2026-05-21T22:13:36.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "12998"
      ],
      "x_nadsec_orgs": [
        "BGNet LLC"
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T22:33:56.826Z",
      "x_nadsec_last_seen": "2026-05-21T22:33:56.826Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-21T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--ffc71754-66f2-4101-b54a-4b59321bbcc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-21T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.133.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T23:05:02.000Z",
      "valid_until": "2026-06-22T23:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-21T22:16:39.593Z",
      "x_nadsec_last_seen": "2026-05-21T22:17:03.713Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132923; asn_org=Vihaan Telecommunication Pvt. Ltd.",
      "id": "indicator--dfa18525-4ff6-41fa-950e-ef79430ed9dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.240.32.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T23:10:44.968Z",
      "x_nadsec_last_seen": "2026-05-21T23:12:49.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132923"
      ],
      "x_nadsec_orgs": [
        "Vihaan Telecommunication Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--27b67c62-d4d6-42ae-bcb9-a1cc082523cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.226.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T23:38:49.381Z",
      "x_nadsec_last_seen": "2026-05-21T23:40:54.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=4780; asn_org=Digital United Inc.",
      "id": "indicator--5905689a-c3e0-482e-a166-e2e5027fcc7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.204.4.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-21T23:55:31.396Z",
      "x_nadsec_last_seen": "2026-05-24T05:42:13.731Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "4780"
      ],
      "x_nadsec_orgs": [
        "Digital United Inc."
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T23:15:28.377Z",
      "x_nadsec_last_seen": "2026-05-21T23:15:28.377Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135175; asn_org=Facts Online Pvt Ltd",
      "id": "indicator--b31fc539-340a-4f50-86ea-e8d6025df4de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.61.72.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T23:17:59.660Z",
      "x_nadsec_last_seen": "2026-05-21T23:18:00.166Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--43159ba6-577a-44c4-a578-fef5db0be810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.237.200.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T23:34:45.653Z",
      "x_nadsec_last_seen": "2026-05-21T23:36:52.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--4fb74f05-e69c-4564-9289-e3cebd776ed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.199.167.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T23:30:33.255Z",
      "x_nadsec_last_seen": "2026-05-21T23:32:38.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b69f9502-861c-4d47-9d93-0d2e9fda2ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-21T23:14:08.677Z",
      "x_nadsec_last_seen": "2026-05-21T23:14:18.837Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=39824; asn_org=JSC Alma Telecommunications",
      "id": "indicator--04e71c24-140a-466f-b188-5ab4cc6e7424",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.36.140.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T23:17:06.342Z",
      "x_nadsec_last_seen": "2026-05-21T23:19:13.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "39824"
      ],
      "x_nadsec_orgs": [
        "JSC Alma Telecommunications"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--56e4da95-8d83-4760-b1d4-b87fdebc703b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.63.124.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T23:53:32.675Z",
      "x_nadsec_last_seen": "2026-05-21T23:55:38.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=29456; asn_org=Rostelecom",
      "id": "indicator--d19699a6-161a-47f8-ac45-b9e85b30570c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.151.114.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-21T23:08:52.294Z",
      "x_nadsec_last_seen": "2026-05-29T07:27:03.902Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29456"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--509b0ccb-a518-41f4-b4c1-76a7ac44fa71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:05:12.000Z",
      "valid_until": "2026-06-23T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-21T23:38:35.909Z",
      "x_nadsec_last_seen": "2026-05-21T23:38:35.909Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-22T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1625578f-98b8-4a30-bb9f-c26e741a2e44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.30.124.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:05:11.000Z",
      "valid_until": "2026-06-23T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T03:47:31.740Z",
      "x_nadsec_last_seen": "2026-05-22T03:47:31.740Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-22T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0bf66409-84c9-47f1-bfb5-705b14a22888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.117.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:05:11.000Z",
      "valid_until": "2026-06-23T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T03:17:48.096Z",
      "x_nadsec_last_seen": "2026-05-22T03:17:48.096Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-22T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--5be8b23b-688e-4473-a7c0-5ab528793401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.235.119.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:05:11.000Z",
      "valid_until": "2026-06-23T04:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-22T03:55:07.712Z",
      "x_nadsec_last_seen": "2026-05-28T18:04:33.945Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-22T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9ae88fec-c87f-473a-920c-ce3e5ba92ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.84.60.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:05:11.000Z",
      "valid_until": "2026-06-23T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T03:39:12.769Z",
      "x_nadsec_last_seen": "2026-05-22T03:39:12.769Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-22T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b2d99a23-51b1-4ef9-90f1-22d86424117b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.93.10.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:05:11.000Z",
      "valid_until": "2026-06-23T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T03:32:33.858Z",
      "x_nadsec_last_seen": "2026-05-22T03:34:38.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JP; asn=2497; asn_org=Internet Initiative Japan Inc.",
      "id": "indicator--54364b7c-7cc8-482f-8107-b8162f9250b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.128.158.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:19:28.622Z",
      "x_nadsec_last_seen": "2026-05-24T17:32:10.673Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2497"
      ],
      "x_nadsec_orgs": [
        "Internet Initiative Japan Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135752; asn_org=Evoke Digital Solutions",
      "id": "indicator--1937c082-f160-4301-9200-7cd564736055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.73.189.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T04:10:10.647Z",
      "x_nadsec_last_seen": "2026-05-22T04:10:10.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135752"
      ],
      "x_nadsec_orgs": [
        "Evoke Digital Solutions"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--81fb6f8f-4f92-4eff-b819-a6b6371aaa6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-22T04:33:41.538Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:06.661Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--4d50633d-3af9-4da7-ae7f-0729b971a27f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T04:34:23.069Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:43.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c37df85d-19fb-442a-9b77-c7971cfc4d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T04:34:08.090Z",
      "x_nadsec_last_seen": "2026-05-22T04:34:08.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--9b526510-6f9d-4768-8dbf-8b21d50c87ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T04:33:44.978Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:57.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:34:26.463Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:21.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2cd98388-4daf-4db9-9dc4-2c929dfacdd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T04:34:14.925Z",
      "x_nadsec_last_seen": "2026-05-22T04:34:14.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b27bbbbd-7f54-44d8-98df-d22c84a3c0c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:34:20.600Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:12.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d941e9e7-defa-42df-bb22-3a88ca3de12d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T04:34:02.719Z",
      "x_nadsec_last_seen": "2026-05-22T04:34:28.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--7bfa793b-6552-486d-bbe5-6c7bd57ada29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T04:33:43.259Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:22.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-22T04:34:09.764Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:08.786Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c2e4cc87-c196-4fe6-883f-663e5a2884f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T04:34:13.207Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:19.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ca1aec5d-e3ee-4b47-89a2-021d35d2e6fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T04:33:49.199Z",
      "x_nadsec_last_seen": "2026-05-22T04:33:59.328Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T04:34:03.070Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:55.760Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8951b63d-09fc-4566-aec1-3e0f85978d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T04:34:35.016Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:41.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T04:33:50.872Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:48.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c5faa1fb-8e4b-4c64-9180-a4bef32898ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T04:33:55.936Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:54.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--745ce08a-7d4b-4836-b5a3-087a5c72ff0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T04:34:01.046Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:50.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--79475ebc-ae55-4861-9935-dcc4c74de0bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:34:20.950Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:00.919Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--7744ae69-5878-436d-8f21-ff22afe43668",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.42.86.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:41:55.145Z",
      "x_nadsec_last_seen": "2026-05-22T04:44:00.233Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5fc9c1da-d01e-487a-adf6-d6eb71ab49e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.177.78.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T04:54:55.422Z",
      "x_nadsec_last_seen": "2026-05-22T05:01:19.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1ebbe706-0ac8-4e8a-b1e7-a05c6d6ab87d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.5.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-22T05:04:40.349Z",
      "x_nadsec_last_seen": "2026-05-22T05:26:09.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--d5313976-cfba-4119-8669-6eba14bda4da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.150.243.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:49:52.683Z",
      "x_nadsec_last_seen": "2026-05-22T04:51:57.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--41c2dc3a-6861-48bb-8acb-99496dea1bd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.53.0.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:13:48.207Z",
      "x_nadsec_last_seen": "2026-05-22T04:15:52.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--a32a7e40-2b27-4f6d-bccf-ad9bb2ee1a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T04:13:24.001Z",
      "x_nadsec_last_seen": "2026-05-22T04:13:24.001Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--57ebd0e7-1eb6-4330-8010-2bba60bc3f8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.115.85.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:18:22.888Z",
      "x_nadsec_last_seen": "2026-05-22T04:23:08.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T04:29:21.931Z",
      "x_nadsec_last_seen": "2026-05-22T04:29:21.931Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=39824; asn_org=JSC Alma Telecommunications",
      "id": "indicator--d1734cfe-4774-4755-bb2d-b8df576d0234",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.134.40.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:05:03.000Z",
      "valid_until": "2026-06-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T04:54:30.018Z",
      "x_nadsec_last_seen": "2026-05-22T04:56:36.980Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "39824"
      ],
      "x_nadsec_orgs": [
        "JSC Alma Telecommunications"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134942; asn_org=Ashok Secure Broadband Network Pvt Ltd",
      "id": "indicator--90121ff0-1713-474d-ae60-71260fa0f9bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.88.135.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-22T05:14:12.873Z",
      "x_nadsec_last_seen": "2026-05-29T03:55:03.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134942"
      ],
      "x_nadsec_orgs": [
        "Ashok Secure Broadband Network Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8dacd753-acd2-4344-af32-fbcc47a30b7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.136.79.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T05:36:08.677Z",
      "x_nadsec_last_seen": "2026-05-22T05:36:08.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--ac3bbac5-adef-422b-86aa-f55ba3f318d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T05:21:36.479Z",
      "x_nadsec_last_seen": "2026-05-22T05:21:41.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=MY; asn=4788; asn_org=TM TECHNOLOGY SERVICES SDN. BHD.",
      "id": "indicator--17cff500-b319-4a54-aa05-81d92cf680e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.187.50.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-22T05:16:21.964Z",
      "x_nadsec_last_seen": "2026-05-22T05:58:09.106Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4788"
      ],
      "x_nadsec_orgs": [
        "TM TECHNOLOGY SERVICES SDN. BHD."
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=150228; asn_org=PT Argiz Mitra Technology",
      "id": "indicator--1c209b84-0dbb-4907-92b1-ca33eb0ec07f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.25.104.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T05:33:29.734Z",
      "x_nadsec_last_seen": "2026-05-22T05:35:37.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "150228"
      ],
      "x_nadsec_orgs": [
        "PT Argiz Mitra Technology"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--61141ba2-ce23-4802-852f-e026b312f911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.216.189.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T05:45:55.846Z",
      "x_nadsec_last_seen": "2026-05-22T05:45:55.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=267214; asn_org=CLICKPLAY PROVEDOR DE ACESSO LTDA - ME",
      "id": "indicator--587d291a-1b40-474c-80a8-97a4baecd5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.230.163.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T05:21:30.013Z",
      "x_nadsec_last_seen": "2026-05-22T05:23:36.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267214"
      ],
      "x_nadsec_orgs": [
        "CLICKPLAY PROVEDOR DE ACESSO LTDA - ME"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--cf8f55cb-c9ea-4f44-b276-013a31e7027c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T05:17:06.967Z",
      "x_nadsec_last_seen": "2026-05-24T05:57:20.945Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--d930d017-1c78-43b9-be63-d12ee601212c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.231.173.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T05:15:16.636Z",
      "x_nadsec_last_seen": "2026-05-22T05:17:23.299Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e4630e55-e413-488f-969b-f4fcbd121af9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T05:29:14.623Z",
      "x_nadsec_last_seen": "2026-05-22T05:29:14.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-22T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e1de4e4c-ad20-413b-b823-04026c5848bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T06:05:11.000Z",
      "valid_until": "2026-06-23T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T05:29:11.482Z",
      "x_nadsec_last_seen": "2026-05-22T05:29:11.482Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134867; asn_org=FUEL NETWORKS",
      "id": "indicator--e81818af-e186-4d9a-bdc1-661c147bb9f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.183.233.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T07:16:32.905Z",
      "x_nadsec_last_seen": "2026-05-22T07:18:38.425Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134867"
      ],
      "x_nadsec_orgs": [
        "FUEL NETWORKS"
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=18049; asn_org=Taiwan Infrastructure Network Technologie",
      "id": "indicator--c866cd2c-8eb8-44e5-910d-249db5666ef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.107.242.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T07:28:40.026Z",
      "x_nadsec_last_seen": "2026-05-22T07:30:44.744Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "18049"
      ],
      "x_nadsec_orgs": [
        "Taiwan Infrastructure Network Technologie"
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1ec57572-c1fd-4967-b6de-ee1639315e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.150.117.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T07:46:38.819Z",
      "x_nadsec_last_seen": "2026-05-22T07:46:59.438Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--6beb4854-05b1-4550-9905-65bb1a9fee14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.69.67.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-22T07:31:58.423Z",
      "x_nadsec_last_seen": "2026-05-27T11:21:33.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KH; asn=24492; asn_org=WiCAM Corporation Ltd.",
      "id": "indicator--45dfcd05-8d50-42b5-8eca-b600c4177d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.15.84.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T07:00:43.564Z",
      "x_nadsec_last_seen": "2026-05-22T07:08:16.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "24492"
      ],
      "x_nadsec_orgs": [
        "WiCAM Corporation Ltd."
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--c195aab6-3004-46fd-865e-546db755439b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.96.139.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T08:02:09.536Z",
      "x_nadsec_last_seen": "2026-05-22T08:02:09.536Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=40021; asn_org=Contabo Inc.",
      "id": "indicator--a38519a4-48e9-46b1-8a5e-b9d3cd326935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.126.84.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T07:25:32.142Z",
      "x_nadsec_last_seen": "2026-05-22T07:25:36.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "40021"
      ],
      "x_nadsec_orgs": [
        "Contabo Inc."
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--607eb93d-f3a7-46b4-9dd8-d6c0448b7528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.161.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T07:54:02.078Z",
      "x_nadsec_last_seen": "2026-05-22T07:54:02.078Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-22T08:05:51.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--cc215133-f976-412d-8b94-caf5d22e63a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T08:05:51.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.221.139.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T08:05:51.000Z",
      "valid_until": "2026-06-23T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T07:46:57.111Z",
      "x_nadsec_last_seen": "2026-05-22T07:47:36.959Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--d735ded6-b71f-45bf-b7b0-0c68aec42bd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.91.102.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T09:11:58.211Z",
      "x_nadsec_last_seen": "2026-05-22T09:12:05.568Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--1d9ae13d-dafc-4883-969e-0bef612a50af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.21.79.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T09:36:36.635Z",
      "x_nadsec_last_seen": "2026-05-22T09:56:36.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50596; asn_org=Informatsionnye Tekhnologii LLC",
      "id": "indicator--85f95402-fbba-41b1-8211-f8466203df7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.201.123.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T09:25:41.636Z",
      "x_nadsec_last_seen": "2026-05-22T09:26:55.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50596"
      ],
      "x_nadsec_orgs": [
        "Informatsionnye Tekhnologii LLC"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--aa0c3e47-6b15-4a91-bca3-f9b3cbb0e648",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.246.133.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-22T09:49:34.899Z",
      "x_nadsec_last_seen": "2026-05-22T10:37:42.132Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**3"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--35dfaceb-8262-499e-aa6e-288020c9d810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.7.0.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T09:19:48.316Z",
      "x_nadsec_last_seen": "2026-05-22T09:21:52.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--70a0ee7a-a43d-4af9-a2e4-40bbadaa1bad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.18.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T09:47:44.124Z",
      "x_nadsec_last_seen": "2026-05-22T09:53:10.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24758; asn_org=Mikroel Ltd",
      "id": "indicator--729668ad-6186-4b30-8aa8-23acfc2529f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.111.2.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T09:20:54.730Z",
      "x_nadsec_last_seen": "2026-05-22T09:30:17.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24758"
      ],
      "x_nadsec_orgs": [
        "Mikroel Ltd"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--72e53e55-d477-4f98-a09c-d04dfa15ba8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.55.2.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T10:02:19.710Z",
      "x_nadsec_last_seen": "2026-05-22T10:02:29.902Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--815570dc-14fc-4d7c-92e0-a1ed6c78674b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.124.91.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T09:41:11.361Z",
      "x_nadsec_last_seen": "2026-05-22T09:43:15.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5e28106b-1129-47e3-823d-e3cc0965db82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.129.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T09:17:15.392Z",
      "x_nadsec_last_seen": "2026-05-22T09:17:15.392Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--3b0a9acf-95a2-410e-ae8a-91cd2d86d2c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.77.38.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T09:17:18.382Z",
      "x_nadsec_last_seen": "2026-05-22T09:18:02.244Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--71687d6f-b64b-4788-9a8f-86c57f627a6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.77.219.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-22T09:13:24.462Z",
      "x_nadsec_last_seen": "2026-05-22T09:41:29.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=131269; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--60777e6c-d963-45ed-a0bc-91a7b01d293f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.205.97.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T09:17:50.732Z",
      "x_nadsec_last_seen": "2026-05-22T09:19:55.785Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131269"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T10:03:57.693Z",
      "x_nadsec_last_seen": "2026-05-22T10:03:57.990Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=44702; asn_org=Jordanian European Internet Services Co LLC",
      "id": "indicator--bbe62386-60ed-4c93-92c8-ddb4ea33e1f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.134.152.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T09:48:04.579Z",
      "x_nadsec_last_seen": "2026-05-22T09:50:11.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "44702"
      ],
      "x_nadsec_orgs": [
        "Jordanian European Internet Services Co LLC"
      ]
    },
    {
      "created": "2026-05-22T10:05:44.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b54be057-c1fe-4993-a49b-019a698dea4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T10:05:44.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.171.100.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:05:44.000Z",
      "valid_until": "2026-06-23T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T10:01:42.765Z",
      "x_nadsec_last_seen": "2026-05-22T10:03:49.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=137666; asn_org=Udaan Internet Services Pvt Ltd",
      "id": "indicator--ed63115d-aaf8-4d69-a03c-7d05ea384515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.168.167.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T11:01:30.552Z",
      "x_nadsec_last_seen": "2026-05-22T11:03:35.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137666"
      ],
      "x_nadsec_orgs": [
        "Udaan Internet Services Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--7047aa9b-2976-4425-9f46-b996f3e2337a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.173.90.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T10:22:29.163Z",
      "x_nadsec_last_seen": "2026-05-22T10:24:33.785Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NP; asn=24550; asn_org=Websurfer Nepal Internet Service Provider",
      "id": "indicator--ecb1a5ee-fca5-4fd1-95c7-653b0c0f2d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.91.173.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T10:05:21.894Z",
      "x_nadsec_last_seen": "2026-05-22T10:05:22.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "24550"
      ],
      "x_nadsec_orgs": [
        "Websurfer Nepal Internet Service Provider"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b35647b9-fc3f-465a-9dbb-d381228bc05e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.178.249.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T10:51:13.341Z",
      "x_nadsec_last_seen": "2026-05-22T10:51:39.617Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--f8a2ebf6-7d6a-4fd0-9e38-e20b5d22a23e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T10:06:36.671Z",
      "x_nadsec_last_seen": "2026-05-22T10:08:44.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=262191; asn_org=LIBERTY NETWORKS DE COLOMBIA S.A.S",
      "id": "indicator--820a9062-554a-43c7-921c-d289fe84c356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.109.26.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T10:29:17.607Z",
      "x_nadsec_last_seen": "2026-05-22T10:31:24.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "262191"
      ],
      "x_nadsec_orgs": [
        "LIBERTY NETWORKS DE COLOMBIA S.A.S"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=132115; asn_org=INDINET SERVICE PRIVATE LIMITED",
      "id": "indicator--19ed8bf7-3fc8-4b35-9cb7-74788e1f6b49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.142.89.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-22T10:37:03.509Z",
      "x_nadsec_last_seen": "2026-05-25T10:02:49.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132115"
      ],
      "x_nadsec_orgs": [
        "INDINET SERVICE PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--5a61b413-0c31-40f8-8d6c-fc66390ad9cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.101.126.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T10:36:29.914Z",
      "x_nadsec_last_seen": "2026-05-22T10:36:29.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=38794; asn_org=UIH",
      "id": "indicator--de8c853e-f74d-42e3-bc93-21a5000045af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.122.49.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T10:52:14.119Z",
      "x_nadsec_last_seen": "2026-05-22T10:54:18.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "38794"
      ],
      "x_nadsec_orgs": [
        "UIH"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cbc23f0a-6773-43b2-8673-721265c6a7f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.40.53.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T10:59:32.872Z",
      "x_nadsec_last_seen": "2026-05-22T11:01:39.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--372351e7-971c-413d-b856-977e470641f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:05:10.000Z",
      "valid_until": "2026-06-23T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T10:33:44.838Z",
      "x_nadsec_last_seen": "2026-05-22T10:33:44.838Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--60460954-7f27-47c3-a626-f7f63e89cb80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.29.198.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T11:22:45.801Z",
      "x_nadsec_last_seen": "2026-05-22T11:22:46.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f47159c1-afc3-4493-a657-f12091c9bcb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.54.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T11:23:59.082Z",
      "x_nadsec_last_seen": "2026-05-22T11:31:04.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9d28318c-d8e0-4ea4-a03b-c350589d2c95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.75.38.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-22T11:24:23.694Z",
      "x_nadsec_last_seen": "2026-05-22T12:01:33.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--ac82624e-f0e2-4abd-8822-cfaeff7be655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.118.177.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T11:34:19.157Z",
      "x_nadsec_last_seen": "2026-05-22T11:35:41.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--3622e3e2-4ef6-484c-a01c-ddba5f4e5c07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.197.145.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T11:37:48.397Z",
      "x_nadsec_last_seen": "2026-05-22T11:39:53.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--78329318-c228-4c6b-8445-e017c73c2b86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.99.157.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T11:42:20.837Z",
      "x_nadsec_last_seen": "2026-05-22T11:44:28.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--2b979fd9-d1a0-4532-97b0-498790f62c33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.183.17.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T11:50:00.927Z",
      "x_nadsec_last_seen": "2026-05-22T11:52:07.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1c8db237-cc6d-4c88-a068-f1382fa9faf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T11:30:45.315Z",
      "x_nadsec_last_seen": "2026-05-22T11:30:47.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--12118745-1c65-4277-9c5a-fdcd8bf7eca8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.17.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T11:14:23.455Z",
      "x_nadsec_last_seen": "2026-05-22T11:14:23.455Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-22T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=FR; asn=3215; asn_org=Orange",
      "id": "indicator--3ad5be59-19a8-4978-99c5-7d29f249e019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.15.73.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:05:10.000Z",
      "valid_until": "2026-06-23T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T11:25:46.871Z",
      "x_nadsec_last_seen": "2026-05-22T11:32:43.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "3215"
      ],
      "x_nadsec_orgs": [
        "Orange"
      ]
    },
    {
      "created": "2026-05-22T13:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4234a592-36cd-4ac3-9b31-cf1637a93177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.91.98.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:05:16.000Z",
      "valid_until": "2026-06-23T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T12:54:13.271Z",
      "x_nadsec_last_seen": "2026-05-22T12:56:22.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-22T13:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8ab2dc39-afcb-4655-ab50-e0ec23ebc26c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:05:16.000Z",
      "valid_until": "2026-06-23T13:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T12:57:07.131Z",
      "x_nadsec_last_seen": "2026-05-22T12:57:17.330Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-22T13:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--630544ce-7b19-461e-af3b-33e145e4353f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.244.170.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:05:16.000Z",
      "valid_until": "2026-06-23T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T12:11:50.750Z",
      "x_nadsec_last_seen": "2026-05-26T19:20:44.650Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-05-22T13:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1f4a5fb8-0caf-4568-96c6-19a1991e76f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.19.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:05:16.000Z",
      "valid_until": "2026-06-23T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T12:41:04.678Z",
      "x_nadsec_last_seen": "2026-05-22T12:48:26.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T13:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--166f47e3-8f22-4806-b127-f9eeb354aace",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.251.242.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:05:16.000Z",
      "valid_until": "2026-06-23T13:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-22T12:09:36.914Z",
      "x_nadsec_last_seen": "2026-05-29T17:57:22.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.",
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-22T13:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=38769; asn_org=PT. Bit Technology Nusantara",
      "id": "indicator--9e9c70aa-9d58-4c1e-aca3-0c9df43e1479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.230.28.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:05:16.000Z",
      "valid_until": "2026-06-23T13:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T12:36:22.245Z",
      "x_nadsec_last_seen": "2026-05-22T12:36:48.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38769"
      ],
      "x_nadsec_orgs": [
        "PT. Bit Technology Nusantara"
      ]
    },
    {
      "created": "2026-05-22T13:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=266073; asn_org=Fausto Silva de Almeida Servicos - ME",
      "id": "indicator--6518a6fb-7f7e-42aa-91cc-490301934bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T13:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.4.151.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:05:16.000Z",
      "valid_until": "2026-06-23T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T13:02:52.446Z",
      "x_nadsec_last_seen": "2026-05-22T13:04:59.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266073"
      ],
      "x_nadsec_orgs": [
        "Fausto Silva de Almeida Servicos - ME"
      ]
    },
    {
      "created": "2026-05-22T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--3e05cb9c-51c1-4e53-bd7f-60ba10bbddc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.117.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:05:10.000Z",
      "valid_until": "2026-06-23T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T13:21:28.906Z",
      "x_nadsec_last_seen": "2026-05-22T13:23:37.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-22T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2cba5ca7-c8df-4c13-8a75-68bcd3082785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.201.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:05:10.000Z",
      "valid_until": "2026-06-23T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T13:50:16.646Z",
      "x_nadsec_last_seen": "2026-05-22T13:52:21.425Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-22T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=264933; asn_org=NTi Telecomunicacoes LTDA.",
      "id": "indicator--e88a91e0-6267-402d-a16e-fa09b8a12e79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.232.41.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:05:10.000Z",
      "valid_until": "2026-06-23T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T13:28:57.635Z",
      "x_nadsec_last_seen": "2026-05-22T13:31:04.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264933"
      ],
      "x_nadsec_orgs": [
        "NTi Telecomunicacoes LTDA."
      ]
    },
    {
      "created": "2026-05-22T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--58dd287c-6a5d-44c8-8c0a-1cb0d3ce1f76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.46.188.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:05:10.000Z",
      "valid_until": "2026-06-23T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T13:09:41.154Z",
      "x_nadsec_last_seen": "2026-05-22T13:11:48.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-22T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--47a72300-efce-426c-aded-d2d379ff0ff8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.153.7.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T14:05:10.000Z",
      "valid_until": "2026-06-23T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T13:46:20.201Z",
      "x_nadsec_last_seen": "2026-05-22T13:48:25.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-22T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17426; asn_org=Primesoftex Ltd",
      "id": "indicator--59a76c72-9b72-43bb-abea-8d9c67e288fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.115.97.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:05:10.000Z",
      "valid_until": "2026-06-23T15:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-22T14:07:33.939Z",
      "x_nadsec_last_seen": "2026-05-27T22:53:03.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17426"
      ],
      "x_nadsec_orgs": [
        "Primesoftex Ltd"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2d4bce27-dfd1-4f50-b1d4-407186aa6139",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.59.231.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-22T15:09:38.004Z",
      "x_nadsec_last_seen": "2026-05-22T15:09:40.860Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T15:59:23.407Z",
      "x_nadsec_last_seen": "2026-05-22T15:59:23.407Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=203851; asn_org=CSD Network Services Ltd",
      "id": "indicator--d75a13f5-f242-49be-a237-d0553a2d0d80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.87.212.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T15:21:24.504Z",
      "x_nadsec_last_seen": "2026-05-22T15:23:30.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "203851"
      ],
      "x_nadsec_orgs": [
        "CSD Network Services Ltd"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC; user(top)=**",
      "id": "indicator--443b2be5-f490-41b9-9197-39cb3c9cc646",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.49.123.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T15:59:01.916Z",
      "x_nadsec_last_seen": "2026-05-22T15:59:01.916Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T15:34:42.973Z",
      "x_nadsec_last_seen": "2026-05-22T15:34:42.973Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=10617; asn_org=SION S.A",
      "id": "indicator--3f893b6d-ee8c-481d-a734-5fe80ba0b835",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.244.200.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-22T15:07:19.068Z",
      "x_nadsec_last_seen": "2026-05-31T16:22:21.655Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10617"
      ],
      "x_nadsec_orgs": [
        "SION S.A"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--7a914c2f-d1fe-48c4-bbdf-21f98d82e648",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.235.210.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T15:32:57.828Z",
      "x_nadsec_last_seen": "2026-05-22T15:35:05.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--b8e9d253-2ce0-4184-ba75-4cc93a74f5f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.57.4.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T15:56:07.353Z",
      "x_nadsec_last_seen": "2026-05-22T16:02:59.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-22T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=269795; asn_org=MLV SA",
      "id": "indicator--e0c30055-60a1-4ba0-99ca-5a2ebfda29b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.184.230.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:05:10.000Z",
      "valid_until": "2026-06-23T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T15:17:51.597Z",
      "x_nadsec_last_seen": "2026-05-22T15:19:58.997Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "269795"
      ],
      "x_nadsec_orgs": [
        "MLV SA"
      ]
    },
    {
      "created": "2026-05-22T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=23923; asn_org=Agni Systems Limited",
      "id": "indicator--f29e8e34-b6bb-4e09-b372-2bdd6fca65e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.148.28.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:05:10.000Z",
      "valid_until": "2026-06-23T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T16:49:07.525Z",
      "x_nadsec_last_seen": "2026-05-22T16:49:33.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23923"
      ],
      "x_nadsec_orgs": [
        "Agni Systems Limited"
      ]
    },
    {
      "created": "2026-05-22T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--0ca99416-12fc-476a-90ae-50e55f702c29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.21.235.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:05:10.000Z",
      "valid_until": "2026-06-23T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T16:49:42.553Z",
      "x_nadsec_last_seen": "2026-05-22T16:58:34.605Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-22T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0fa778ff-e856-4112-a989-33059da1178e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.154.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:05:10.000Z",
      "valid_until": "2026-06-23T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T16:21:18.754Z",
      "x_nadsec_last_seen": "2026-05-22T16:21:18.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-22T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--61bc5898-1e1b-4156-96fb-3099200ffd1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:05:10.000Z",
      "valid_until": "2026-06-23T17:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T17:03:25.363Z",
      "x_nadsec_last_seen": "2026-05-25T17:18:09.800Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-22T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--00321099-af7d-4ff5-a15b-1a0208a9d736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.34.246.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:05:10.000Z",
      "valid_until": "2026-06-23T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T16:54:25.694Z",
      "x_nadsec_last_seen": "2026-05-22T16:56:32.383Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-05-22T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--037dc04c-fdf7-4ea8-a874-18464bcd10d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.179.241.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:05:10.000Z",
      "valid_until": "2026-06-23T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T16:30:10.969Z",
      "x_nadsec_last_seen": "2026-05-22T16:30:11.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5659eeb0-b80f-47c1-9804-3c2a8b3b5a3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.103.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T17:21:26.341Z",
      "x_nadsec_last_seen": "2026-05-22T17:23:35.248Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=18429; asn_org=Extra-Lan Technologies Co., LTD",
      "id": "indicator--2c768c71-1c3d-457c-9121-764ad488fc97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.50.47.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T17:35:32.260Z",
      "x_nadsec_last_seen": "2026-05-22T17:37:36.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "18429"
      ],
      "x_nadsec_orgs": [
        "Extra-Lan Technologies Co., LTD"
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4812; asn_org=China Telecom Group; user(top)=**",
      "id": "indicator--a9af326f-a082-4f94-8151-59aaf2740406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.172.177.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T17:25:31.685Z",
      "x_nadsec_last_seen": "2026-05-29T12:20:34.551Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GT; asn=14754; asn_org=TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA",
      "id": "indicator--9ba0ecf1-576a-4bac-bd6a-fdd99fa4facb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.151.190.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T17:49:39.535Z",
      "x_nadsec_last_seen": "2026-05-22T17:51:46.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GT"
      ],
      "x_nadsec_asns": [
        "14754"
      ],
      "x_nadsec_orgs": [
        "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0950256a-4ab1-4830-96fa-d743fe4e9df3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T17:30:47.970Z",
      "x_nadsec_last_seen": "2026-05-22T17:30:47.970Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--b9c24dfc-7fae-4a66-b76f-cefa672139f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.164.178.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T17:33:47.713Z",
      "x_nadsec_last_seen": "2026-05-22T17:37:54.993Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--f882eb81-99b8-40b0-a298-664d41ede0e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.112.94.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T17:12:55.299Z",
      "x_nadsec_last_seen": "2026-05-22T17:15:01.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--eb0dc6be-ddcf-4c1f-97f3-132846a95056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.19.208.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T17:58:55.171Z",
      "x_nadsec_last_seen": "2026-05-22T18:02:36.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-22T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--8eecf478-1103-42c1-9caf-46013778d802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.68.212.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T18:05:10.000Z",
      "valid_until": "2026-06-23T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T17:37:54.754Z",
      "x_nadsec_last_seen": "2026-05-22T17:38:45.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32098"
      ],
      "x_nadsec_orgs": [
        "Transtelco Inc"
      ]
    },
    {
      "created": "2026-05-22T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8f9458c4-8612-4c01-aa34-88c7f85ef6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.101.184.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:05:06.000Z",
      "valid_until": "2026-06-23T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T18:32:59.684Z",
      "x_nadsec_last_seen": "2026-05-22T18:35:04.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-22T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JP; asn=135161; asn_org=GMO-Z com NetDesign Holdings Co., Ltd.",
      "id": "indicator--ceab398a-6ba1-45f3-a23a-443465481d2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.95.90.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:05:06.000Z",
      "valid_until": "2026-06-23T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T18:19:18.558Z",
      "x_nadsec_last_seen": "2026-05-25T18:55:39.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135161"
      ],
      "x_nadsec_orgs": [
        "GMO-Z com NetDesign Holdings Co., Ltd."
      ]
    },
    {
      "created": "2026-05-22T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA; user(top)=**",
      "id": "indicator--c4000973-6aa7-4afc-bde0-7e4baa76b79b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.32.48.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:05:06.000Z",
      "valid_until": "2026-06-23T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T18:25:00.146Z",
      "x_nadsec_last_seen": "2026-05-22T18:25:00.146Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-22T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--23b6a326-67e5-41a0-afc3-0de2260777a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:05:06.000Z",
      "valid_until": "2026-06-23T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T18:35:33.642Z",
      "x_nadsec_last_seen": "2026-05-30T16:48:01.288Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-22T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c18f8283-918d-4875-a044-e10f48ab158c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:05:06.000Z",
      "valid_until": "2026-06-23T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T18:26:02.278Z",
      "x_nadsec_last_seen": "2026-05-22T18:26:02.278Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-22T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e7e26056-6230-4807-8535-a6b17f64c441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:05:06.000Z",
      "valid_until": "2026-06-23T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T18:41:21.267Z",
      "x_nadsec_last_seen": "2026-05-22T18:41:21.267Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LA; asn=131267; asn_org=Star Telecom",
      "id": "indicator--a3189e32-2e71-459c-a7cb-dc2feccd308e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.1.28.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T20:38:12.516Z",
      "x_nadsec_last_seen": "2026-05-22T20:44:27.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "131267"
      ],
      "x_nadsec_orgs": [
        "Star Telecom"
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=36352; asn_org=HostPapa; user(top)=p******s",
      "id": "indicator--d939658d-271b-4e6c-ad15-11303e3cb95d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.175.34.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-21T13:40:44.781Z",
      "x_nadsec_last_seen": "2026-05-22T22:04:28.336Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n",
        "p******s",
        "u****e",
        "a*******r"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=263701; asn_org=RGO SOMOS CABLE, C.A.",
      "id": "indicator--42464042-a62f-4d5f-9b88-ca5678c9c022",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '131.221.115.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T20:30:16.571Z",
      "x_nadsec_last_seen": "2026-05-22T20:32:22.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "263701"
      ],
      "x_nadsec_orgs": [
        "RGO SOMOS CABLE, C.A."
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=14868; asn_org=Ligga Telecomunicacoes S.A.",
      "id": "indicator--2d7f7430-f76e-45a7-a336-b4b935ac774e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.220.176.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T20:54:09.231Z",
      "x_nadsec_last_seen": "2026-05-22T20:56:15.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "14868"
      ],
      "x_nadsec_orgs": [
        "Ligga Telecomunicacoes S.A."
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=38283; asn_org=CHINANET SiChuan Telecom Internet Data Center; user(top)=**",
      "id": "indicator--d5a718a2-baf2-4d63-b351-c9eb64dff4ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.151.52.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T20:09:58.923Z",
      "x_nadsec_last_seen": "2026-05-22T20:09:58.923Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "38283"
      ],
      "x_nadsec_orgs": [
        "CHINANET SiChuan Telecom Internet Data Center"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--40dbce63-f7c5-420e-93e9-b7b795f0186c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.212.210.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T20:13:55.011Z",
      "x_nadsec_last_seen": "2026-05-22T20:20:20.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--3a3a6250-9a22-4f41-a404-5752ba73a8be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.1.217.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T20:20:52.386Z",
      "x_nadsec_last_seen": "2026-05-22T20:20:59.742Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--59507f24-aaa6-4392-8760-db41459eb604",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.199.124.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T20:06:25.025Z",
      "x_nadsec_last_seen": "2026-05-22T20:13:31.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--862fc2ff-d946-49fe-8a1d-af4764069672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.140.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T20:49:47.805Z",
      "x_nadsec_last_seen": "2026-05-22T20:49:47.805Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--c559f470-df9d-47b1-b544-802b11bc8606",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T20:20:47.541Z",
      "x_nadsec_last_seen": "2026-05-22T20:20:47.541Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--15b07647-c025-4186-ae53-ea42f530b1d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T20:30:40.401Z",
      "x_nadsec_last_seen": "2026-05-27T10:57:21.709Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-22T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--888f6c06-5c8a-48b0-8577-4c03ee8d7d20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-22T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.235.122.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:05:10.000Z",
      "valid_until": "2026-06-23T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T20:31:35.409Z",
      "x_nadsec_last_seen": "2026-05-22T20:38:45.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--2bda168e-aea6-4247-9295-2d8d6f572d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.147.8.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T23:46:49.614Z",
      "x_nadsec_last_seen": "2026-05-22T23:48:54.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2f488169-a4d1-4449-be3b-380fbfff4b50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.139.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-22T23:42:17.422Z",
      "x_nadsec_last_seen": "2026-05-23T02:13:30.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--61061642-5898-4269-8d87-20bcaee19da3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.209.35.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T23:25:08.830Z",
      "x_nadsec_last_seen": "2026-05-22T23:27:15.493Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--e2e48dfc-c496-4cb8-bdff-82450e58051b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.206.231.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T23:28:50.690Z",
      "x_nadsec_last_seen": "2026-05-22T23:36:52.723Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0aef3bb9-1d4b-4706-8f22-10c20cd9fb43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.19.245.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-22T23:47:52.696Z",
      "x_nadsec_last_seen": "2026-05-22T23:47:52.696Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7ae79a19-74b0-4545-ab29-28589b468ee1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.195.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T23:09:53.374Z",
      "x_nadsec_last_seen": "2026-05-22T23:10:03.784Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4495702b-9b27-40b7-a7ca-a17472bc1e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.130.253.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T23:24:51.675Z",
      "x_nadsec_last_seen": "2026-05-22T23:26:56.660Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--96fa3441-30d1-49f2-bc9c-bc18745072b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.240.3.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T00:04:46.723Z",
      "x_nadsec_last_seen": "2026-05-31T14:02:20.360Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--41a7ab20-5502-466f-b4c9-9679274f7b25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.235.216.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-22T23:57:03.261Z",
      "x_nadsec_last_seen": "2026-05-23T00:16:46.732Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--37ba253c-a90c-4a29-b3e3-e3e73e3723ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.142.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T00:01:14.342Z",
      "x_nadsec_last_seen": "2026-05-23T00:01:38.477Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-23T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--36987b02-9b9f-4b9e-9c3a-a2b10c1dc427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.12.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:05:05.000Z",
      "valid_until": "2026-06-24T00:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T23:05:09.676Z",
      "x_nadsec_last_seen": "2026-05-22T23:05:33.435Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--5826df55-1684-4dd2-a271-b91e904e454b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.53.171.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:05:03.000Z",
      "valid_until": "2026-06-24T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T00:56:33.122Z",
      "x_nadsec_last_seen": "2026-05-23T00:56:33.122Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--af879de0-c681-4fdb-b260-ad221fb7f78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.250.63.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:05:03.000Z",
      "valid_until": "2026-06-24T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T00:38:33.027Z",
      "x_nadsec_last_seen": "2026-05-23T00:38:33.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:05:03.000Z",
      "valid_until": "2026-06-24T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T00:19:16.717Z",
      "x_nadsec_last_seen": "2026-05-23T00:19:16.717Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CY; asn=6866; asn_org=Cyprus Telecommunications Authority",
      "id": "indicator--5164c4b0-0fa2-441c-a742-f717124ffb25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.153.115.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:05:03.000Z",
      "valid_until": "2026-06-24T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T00:59:52.284Z",
      "x_nadsec_last_seen": "2026-05-23T01:01:59.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "6866"
      ],
      "x_nadsec_orgs": [
        "Cyprus Telecommunications Authority"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a51318ac-f4f5-4952-bc19-3ac17cd96ed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.254.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T01:56:17.191Z",
      "x_nadsec_last_seen": "2026-05-23T01:56:17.191Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--697fa09a-9651-445b-a6c1-4f47f38e089f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.212.253.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T01:14:38.170Z",
      "x_nadsec_last_seen": "2026-05-23T01:16:43.432Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--d6775489-ae85-4d4e-b7e4-e497840327a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.199.84.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T01:10:50.266Z",
      "x_nadsec_last_seen": "2026-05-23T01:10:50.266Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--66e54e36-a8da-409b-94c7-54bb6a5d97d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.241.131.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-23T01:53:24.618Z",
      "x_nadsec_last_seen": "2026-05-23T01:56:13.837Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--80b39899-cd06-47de-a783-ccf66509ee11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.80.88.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T01:45:12.563Z",
      "x_nadsec_last_seen": "2026-05-23T01:45:13.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56046; asn_org=China Mobile communications corporation",
      "id": "indicator--89a9061e-0e05-4d3c-8a2b-a511cbacc5e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.113.145.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T01:30:07.885Z",
      "x_nadsec_last_seen": "2026-05-23T01:32:14.004Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56046"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--3e028fe0-7a37-43e1-a30e-3a43a46ac7c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.205.56.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T01:32:46.208Z",
      "x_nadsec_last_seen": "2026-05-23T01:32:51.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=267378; asn_org=CWMC TELECOM LTDA ME",
      "id": "indicator--bcd23c97-6dae-428a-a6a7-71407d4aa4fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.234.193.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T01:59:48.515Z",
      "x_nadsec_last_seen": "2026-05-23T02:01:55.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267378"
      ],
      "x_nadsec_orgs": [
        "CWMC TELECOM LTDA ME"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=48832; asn_org=Jordanian mobile phone services Ltd",
      "id": "indicator--c5e03180-1bb4-45d0-ae0e-3fe85db02a40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.32.109.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T01:13:51.975Z",
      "x_nadsec_last_seen": "2026-05-23T01:15:58.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "48832"
      ],
      "x_nadsec_orgs": [
        "Jordanian mobile phone services Ltd"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-23T01:43:27.481Z",
      "x_nadsec_last_seen": "2026-05-23T01:44:15.057Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=24626; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--b971620f-972c-4e93-8c54-90e106fa2e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.18.134.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T01:44:36.950Z",
      "x_nadsec_last_seen": "2026-05-23T01:46:01.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24626"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-05-23T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--bbfc5d29-795c-4fa9-b02b-333b4aa60bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.218.177.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:05:10.000Z",
      "valid_until": "2026-06-24T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T01:31:13.481Z",
      "x_nadsec_last_seen": "2026-05-23T01:38:10.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e34a9c6d-c94e-468b-911a-ed46cce3a916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.161.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:05:10.000Z",
      "valid_until": "2026-06-24T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T02:31:42.245Z",
      "x_nadsec_last_seen": "2026-05-23T02:33:47.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--222cac62-331c-4e16-9788-59c3540af115",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.82.92.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:05:10.000Z",
      "valid_until": "2026-06-24T03:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-23T02:57:48.523Z",
      "x_nadsec_last_seen": "2026-05-23T04:41:54.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--ad278eee-cf70-45e1-bb80-c97f35f4dd6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.227.21.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:05:10.000Z",
      "valid_until": "2026-06-24T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T02:55:40.041Z",
      "x_nadsec_last_seen": "2026-05-23T02:56:25.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-05-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f12481a3-e44f-4f14-9363-d556a890660c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:05:10.000Z",
      "valid_until": "2026-06-24T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T03:02:51.501Z",
      "x_nadsec_last_seen": "2026-05-31T00:29:01.317Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7bcca49e-d9a5-43f6-b66e-45549566c962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.10.42.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:05:10.000Z",
      "valid_until": "2026-06-24T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T02:40:40.195Z",
      "x_nadsec_last_seen": "2026-05-23T02:42:46.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4811; asn_org=China Telecom Group; user(top)=**",
      "id": "indicator--d477bb3c-c919-473f-99b0-a24ea77b79c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.89.134.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T03:27:47.280Z",
      "x_nadsec_last_seen": "2026-05-25T20:28:17.520Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4811"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=141816; asn_org=Velankani Information Systems Limited",
      "id": "indicator--491ad743-de0d-46b1-b07b-bbe50fe7a512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.89.8.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T03:40:36.516Z",
      "x_nadsec_last_seen": "2026-05-23T03:42:41.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141816"
      ],
      "x_nadsec_orgs": [
        "Velankani Information Systems Limited"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--086d59f4-61e0-42e0-b835-2906351b97e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.171.59.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T03:14:36.853Z",
      "x_nadsec_last_seen": "2026-05-23T03:16:41.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T03:24:37.071Z",
      "x_nadsec_last_seen": "2026-05-30T13:26:58.588Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--423b9d04-ef92-4aef-a3b2-fae5551cec86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.96.39.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T03:30:21.701Z",
      "x_nadsec_last_seen": "2026-05-23T03:30:26.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T03:26:00.484Z",
      "x_nadsec_last_seen": "2026-05-23T03:26:00.484Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--cf9c5d6e-d93a-4d4c-9135-ef8a258973c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.69.11.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T03:16:16.430Z",
      "x_nadsec_last_seen": "2026-05-23T03:22:44.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b8e27683-7578-4adf-9392-36bc7f71c1b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.23.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T04:02:06.252Z",
      "x_nadsec_last_seen": "2026-05-23T04:02:06.252Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--cbf60603-758a-45cd-b367-f8eeeae4e5fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.183.224.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T03:35:50.543Z",
      "x_nadsec_last_seen": "2026-05-23T03:37:57.257Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--fa646202-2512-40ce-aa3a-b51fd5f23809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.200.82.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T03:05:16.949Z",
      "x_nadsec_last_seen": "2026-05-23T03:07:21.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T03:40:28.753Z",
      "x_nadsec_last_seen": "2026-05-23T03:40:28.753Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-23T04:06:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5b214367-8230-46bc-b589-521a79bc3d13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T04:06:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.75.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T04:06:21.000Z",
      "valid_until": "2026-06-24T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T04:01:52.942Z",
      "x_nadsec_last_seen": "2026-05-23T04:02:04.247Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bd8faca9-2c0b-4996-8d3c-5ed034852f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.136.249.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T04:25:46.460Z",
      "x_nadsec_last_seen": "2026-05-23T04:32:45.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--c8e913d3-453e-47a9-aced-6751d184fb2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.161.115.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T04:29:12.983Z",
      "x_nadsec_last_seen": "2026-05-23T04:29:14.227Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--1b43d2cc-e8a8-4223-adff-76a0505abbbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.110.42.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T04:08:52.761Z",
      "x_nadsec_last_seen": "2026-05-23T04:15:24.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--475ac818-bb49-40a3-acfa-67861b4b9156",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '126.77.194.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T04:58:17.012Z",
      "x_nadsec_last_seen": "2026-05-23T05:00:22.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "17676"
      ],
      "x_nadsec_orgs": [
        "SoftBank Corp."
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--584d38fd-103c-48f5-a8ff-6afd390fb06e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.253.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T04:57:35.913Z",
      "x_nadsec_last_seen": "2026-05-23T04:57:35.913Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T04:21:11.504Z",
      "x_nadsec_last_seen": "2026-05-31T00:38:34.993Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a4ded840-4db1-4529-abd7-843792b7ca4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.66.180.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T04:47:13.818Z",
      "x_nadsec_last_seen": "2026-05-23T04:47:18.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--56ad332b-43a6-4024-9183-88a2d440fa37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.80.118.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-23T04:53:33.378Z",
      "x_nadsec_last_seen": "2026-05-23T04:56:41.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=PA; asn=269736; asn_org=PACIFIC NETWORK COMMUNICATION S.A.",
      "id": "indicator--3c8926f6-bc41-4492-881f-24e41946471c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.181.69.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T04:37:08.844Z",
      "x_nadsec_last_seen": "2026-05-23T04:40:53.003Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "269736"
      ],
      "x_nadsec_orgs": [
        "PACIFIC NETWORK COMMUNICATION S.A."
      ]
    },
    {
      "created": "2026-05-23T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:05:11.000Z",
      "valid_until": "2026-06-24T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T04:10:55.868Z",
      "x_nadsec_last_seen": "2026-05-29T14:01:56.034Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-23T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=CZ; asn=213373; asn_org=IP Connect Inc",
      "id": "indicator--5a8b1dd6-5a1e-47f3-b19e-0d03ce2a9494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.19.173.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:05:11.000Z",
      "valid_until": "2026-06-24T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T05:32:13.823Z",
      "x_nadsec_last_seen": "2026-05-23T05:51:05.523Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CZ"
      ],
      "x_nadsec_asns": [
        "213373"
      ],
      "x_nadsec_orgs": [
        "IP Connect Inc"
      ]
    },
    {
      "created": "2026-05-23T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--abbb9b33-1484-4925-9dff-b971832eb102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:05:11.000Z",
      "valid_until": "2026-06-24T06:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-22T21:52:32.283Z",
      "x_nadsec_last_seen": "2026-05-29T15:10:44.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-23T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=201127; asn_org=Fastfone s.r.l.",
      "id": "indicator--d8553c2b-6442-4c0c-ab5e-9006c1e63492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.84.91.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:05:11.000Z",
      "valid_until": "2026-06-24T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T05:57:29.795Z",
      "x_nadsec_last_seen": "2026-05-23T05:59:36.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "201127"
      ],
      "x_nadsec_orgs": [
        "Fastfone s.r.l."
      ]
    },
    {
      "created": "2026-05-23T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--0ad9e466-0bdf-4f02-967f-7e1c4f4f7e6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.130.6.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:05:11.000Z",
      "valid_until": "2026-06-24T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T05:21:06.861Z",
      "x_nadsec_last_seen": "2026-05-23T05:21:06.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-23T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--a7e1f6fe-255d-4055-8132-ec0b19969bbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.227.16.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:05:11.000Z",
      "valid_until": "2026-06-24T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T05:59:49.121Z",
      "x_nadsec_last_seen": "2026-05-23T06:00:46.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-05-23T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--808ac1df-f2a1-446d-980f-f33dee3de511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.206.157.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:05:11.000Z",
      "valid_until": "2026-06-24T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T05:32:53.848Z",
      "x_nadsec_last_seen": "2026-05-23T05:33:19.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-23T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--8ca993fe-accf-485b-bfad-1b085da05885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:05:11.000Z",
      "valid_until": "2026-06-24T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T06:00:37.501Z",
      "x_nadsec_last_seen": "2026-05-23T06:00:37.501Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--f5cbb35a-547d-4b46-8818-a0a8b99bd8ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.255.47.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T06:44:23.166Z",
      "x_nadsec_last_seen": "2026-05-23T06:48:31.299Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--a5789ebe-b3d6-4f0c-9ba8-ceece7ec7344",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.40.230.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T07:01:39.810Z",
      "x_nadsec_last_seen": "2026-05-23T07:01:42.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--72ac84cf-773f-4ea6-a636-8f1791cfa58a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.27.39.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T06:52:23.463Z",
      "x_nadsec_last_seen": "2026-05-23T06:54:30.276Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--063373f2-1573-4e8e-ae68-b4e4160d5c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.9.113.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T07:00:42.290Z",
      "x_nadsec_last_seen": "2026-05-23T07:02:49.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--01db9e4a-fd0b-445c-afd7-15ebac6dee2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.227.11.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T06:25:09.563Z",
      "x_nadsec_last_seen": "2026-05-23T06:32:19.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--037bf6f6-676b-4cd2-8d48-22b8c98595b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T06:55:41.985Z",
      "x_nadsec_last_seen": "2026-05-29T09:48:00.800Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9f4b5a78-b33e-49f2-9653-948adf1837e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.90.11.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T06:49:05.597Z",
      "x_nadsec_last_seen": "2026-05-23T06:51:10.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-23T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ef18ff4f-ec06-4e5f-bb14-d4fb6945681d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:05:10.000Z",
      "valid_until": "2026-06-24T07:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T06:27:27.478Z",
      "x_nadsec_last_seen": "2026-05-23T06:27:37.673Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--b33554c8-5ed8-4b74-ab7c-7534a5eb7731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.194.7.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T07:32:47.464Z",
      "x_nadsec_last_seen": "2026-05-23T07:34:52.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=327726; asn_org=Newtelco",
      "id": "indicator--e73212b8-2bd7-45d9-b5ea-feb1e9969d85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.72.7.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T07:39:40.274Z",
      "x_nadsec_last_seen": "2026-05-23T07:41:48.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327726"
      ],
      "x_nadsec_orgs": [
        "Newtelco"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--a30ce149-bad2-42cc-b0dd-fd85355c8888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.94.209.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T07:34:03.678Z",
      "x_nadsec_last_seen": "2026-05-23T20:56:44.095Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--22051bd6-75d3-4aa5-a522-0b491386e66a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T07:37:50.601Z",
      "x_nadsec_last_seen": "2026-05-23T07:39:58.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=httpd; ports=81; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--8fd8a558-434b-47b8-8022-11f2532187ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-05-20T18:07:16.956Z",
      "x_nadsec_last_seen": "2026-05-23T07:39:53.684Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8c346d6d-f0b8-4641-bfac-54fbe75539c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.235.218.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T07:50:03.030Z",
      "x_nadsec_last_seen": "2026-05-23T07:57:20.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--b7ce0d24-bc4a-4d77-872f-56724c402348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T07:18:38.823Z",
      "x_nadsec_last_seen": "2026-05-24T14:29:31.753Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0049b04e-4aee-4651-b147-6d9d6727cf7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.229.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T07:16:07.294Z",
      "x_nadsec_last_seen": "2026-05-23T07:16:07.294Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--c94f60b0-0106-45ea-8797-b77d70aff7a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:05:10.000Z",
      "valid_until": "2026-06-24T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T07:26:32.976Z",
      "x_nadsec_last_seen": "2026-05-23T07:26:32.976Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--337003d6-58fe-4dd7-9979-7bcae10ef315",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.28.194.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-23T08:14:20.804Z",
      "x_nadsec_last_seen": "2026-05-25T18:47:53.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--7e433744-efbe-4e2e-ac7f-fd12838772b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.92.204.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T08:41:43.391Z",
      "x_nadsec_last_seen": "2026-05-23T08:43:49.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--0b1d7c48-07c6-461a-8a76-32daf18840f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.73.203.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T08:24:25.011Z",
      "x_nadsec_last_seen": "2026-05-23T08:26:29.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--003f01be-1622-4330-b726-fc8431990a45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.112.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T08:21:11.165Z",
      "x_nadsec_last_seen": "2026-05-23T08:21:11.165Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=45588; asn_org=Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In",
      "id": "indicator--7ec5b3f5-3406-41f1-b25a-1c2ab23fa8b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.211.183.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T08:46:10.394Z",
      "x_nadsec_last_seen": "2026-05-23T08:48:16.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45588"
      ],
      "x_nadsec_orgs": [
        "Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In"
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=2715; asn_org=Fundacao Carlos Chagas Filho de Amparo a Pesquisa",
      "id": "indicator--6935c409-0b00-472b-83a5-5cb0755912a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.156.24.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-13T14:47:25.507Z",
      "x_nadsec_last_seen": "2026-05-23T08:43:39.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "2715"
      ],
      "x_nadsec_orgs": [
        "Fundacao Carlos Chagas Filho de Amparo a Pesquisa"
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--e65f1af7-da7c-47e8-9db7-29fcc4fb82fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.102.230.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T08:36:01.998Z",
      "x_nadsec_last_seen": "2026-05-23T08:40:18.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=KR; asn=4766; asn_org=Korea Telecom",
      "id": "indicator--b026195a-a71b-4a09-839c-f5624d509209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.78.182.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:05:10.000Z",
      "valid_until": "2026-06-24T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T08:15:31.503Z",
      "x_nadsec_last_seen": "2026-05-23T08:15:31.503Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ]
    },
    {
      "created": "2026-05-23T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--24fca922-086a-4657-ac97-0df77cfc8553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.177.17.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:05:11.000Z",
      "valid_until": "2026-06-24T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T09:38:14.530Z",
      "x_nadsec_last_seen": "2026-05-23T09:38:19.261Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8107e2e7-bb47-42dd-adfc-de832a2cb991",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.253.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:05:11.000Z",
      "valid_until": "2026-06-24T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T09:19:45.974Z",
      "x_nadsec_last_seen": "2026-05-23T09:19:45.974Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--94df255c-3ed2-438a-a160-7c26019930a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.183.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:05:11.000Z",
      "valid_until": "2026-06-24T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T09:35:26.285Z",
      "x_nadsec_last_seen": "2026-05-23T15:30:55.496Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-23T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--ccc3b763-de97-4b4e-8e31-56ac7a79b15c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.7.139.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:05:11.000Z",
      "valid_until": "2026-06-24T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T09:34:14.914Z",
      "x_nadsec_last_seen": "2026-05-23T09:36:21.346Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-05-23T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c95bdd32-79ac-4fb1-b2ef-ea65257980a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.228.173.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:05:11.000Z",
      "valid_until": "2026-06-24T10:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-23T09:09:26.836Z",
      "x_nadsec_last_seen": "2026-05-23T09:58:09.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-23T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:05:11.000Z",
      "valid_until": "2026-06-24T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T17:41:24.902Z",
      "x_nadsec_last_seen": "2026-05-23T09:36:04.678Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-23T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--45f357c2-d545-4b27-8547-573feaf1d7cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.219.88.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:05:10.000Z",
      "valid_until": "2026-06-24T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T10:11:26.766Z",
      "x_nadsec_last_seen": "2026-05-23T10:18:33.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-23T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--ec08038c-0ba2-4885-988b-e1c5512009bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.147.9.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:05:10.000Z",
      "valid_until": "2026-06-24T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T10:15:47.359Z",
      "x_nadsec_last_seen": "2026-05-23T10:17:51.917Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-23T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=SC; asn=8796; asn_org=FASTNET DATA INC",
      "id": "indicator--00dbf0ff-a962-46e3-b5ad-b14d640baab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.201.78.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:05:10.000Z",
      "valid_until": "2026-06-24T11:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-23T10:42:40.000Z",
      "x_nadsec_last_seen": "2026-05-24T14:28:17.462Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "8796"
      ],
      "x_nadsec_orgs": [
        "FASTNET DATA INC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e0db6bc3-637f-4ff1-bfac-23132cf839dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.117.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:05:10.000Z",
      "valid_until": "2026-06-24T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T10:24:03.744Z",
      "x_nadsec_last_seen": "2026-05-23T10:26:10.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-23T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.39.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:05:10.000Z",
      "valid_until": "2026-06-24T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-23T10:08:43.245Z",
      "x_nadsec_last_seen": "2026-05-23T10:12:17.479Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "135",
        "445",
        "1433",
        "1883",
        "3306",
        "27017",
        "40391"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--deca0f17-3c8f-408d-ac9d-a6947d122650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:05:10.000Z",
      "valid_until": "2026-06-24T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T10:58:47.859Z",
      "x_nadsec_last_seen": "2026-05-23T10:58:47.859Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--a25cefec-cf6c-47af-bf92-7648812e1427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.119.18.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T11:28:59.920Z",
      "x_nadsec_last_seen": "2026-05-23T11:31:07.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--a55de9f1-a273-4122-977c-2fcfb83c25bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.173.23.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T11:33:26.287Z",
      "x_nadsec_last_seen": "2026-05-23T11:39:50.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--89de1f94-8e7a-49ae-a1a3-1ec1f51798fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.140.180.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T11:13:25.078Z",
      "x_nadsec_last_seen": "2026-05-23T11:13:25.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--ad5f922f-2f47-4244-9068-0e02c84346a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.140.180.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T11:13:24.837Z",
      "x_nadsec_last_seen": "2026-05-23T11:13:24.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=28509; asn_org=Cablemas Telecomunicaciones SA de CV",
      "id": "indicator--1637c448-10f3-45d3-bb42-b60ffc99c71b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.221.229.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T11:10:55.448Z",
      "x_nadsec_last_seen": "2026-05-23T11:13:00.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28509"
      ],
      "x_nadsec_orgs": [
        "Cablemas Telecomunicaciones SA de CV"
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--579ff957-5d8c-43ac-9a79-17f16833515c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.29.8.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T11:56:39.641Z",
      "x_nadsec_last_seen": "2026-05-23T11:56:39.994Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--3a855a69-39db-4a3c-8a26-577d940ba143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-23T12:02:49.415Z",
      "x_nadsec_last_seen": "2026-05-23T12:04:17.106Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--c8b6fd2c-4539-45f2-867b-2618eab7cd6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T12:03:46.308Z",
      "x_nadsec_last_seen": "2026-05-23T12:03:46.308Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--75888377-6c70-470f-a941-f40336b1e5ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T12:03:02.171Z",
      "x_nadsec_last_seen": "2026-05-23T12:04:01.577Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-23T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--6d6f5967-a490-4686-82cb-0a0c9d6602f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:05:10.000Z",
      "valid_until": "2026-06-24T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T12:03:31.886Z",
      "x_nadsec_last_seen": "2026-05-23T12:03:31.886Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4275866a-0366-4f06-9d09-a73920387078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.96.12.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T12:45:14.761Z",
      "x_nadsec_last_seen": "2026-05-23T12:47:19.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=23923; asn_org=Agni Systems Limited",
      "id": "indicator--4beaf755-5236-4c2c-a687-887915dff5c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.148.60.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-23T12:22:33.847Z",
      "x_nadsec_last_seen": "2026-05-24T08:35:10.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23923"
      ],
      "x_nadsec_orgs": [
        "Agni Systems Limited"
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45528; asn_org=Tikona Infinet Ltd.",
      "id": "indicator--6bd2725b-af41-4377-b6f5-1d43b8b9db48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.136.194.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T12:14:10.381Z",
      "x_nadsec_last_seen": "2026-05-23T12:20:46.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45528"
      ],
      "x_nadsec_orgs": [
        "Tikona Infinet Ltd."
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--de42d5f6-f029-469d-91b5-02f5739e212d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.100.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T12:08:19.751Z",
      "x_nadsec_last_seen": "2026-05-23T12:14:33.222Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--d4dbe4f5-47ef-4ddf-8eb7-bce4f62da548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.120.234.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-23T12:55:27.228Z",
      "x_nadsec_last_seen": "2026-05-27T19:38:02.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=SG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c7eb26de-c700-4bdc-992b-223cd076c22a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.255.220.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-23T12:56:59.586Z",
      "x_nadsec_last_seen": "2026-05-23T12:57:17.408Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--5a434db0-2dd8-47b5-ac2b-75baae4afe14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T12:59:28.550Z",
      "x_nadsec_last_seen": "2026-05-23T12:59:28.550Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--111fbc77-6388-4bec-bbf9-9f8f6e713f40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T13:05:10.000Z",
      "valid_until": "2026-06-24T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T12:30:53.113Z",
      "x_nadsec_last_seen": "2026-05-23T12:30:53.417Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-23T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--efcf9a90-be4a-4ddc-8709-00729f2924ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.225.92.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:05:10.000Z",
      "valid_until": "2026-06-24T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T13:09:41.783Z",
      "x_nadsec_last_seen": "2026-05-23T13:09:41.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-23T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--4ff1a981-c4f7-4fb2-9d80-18061faa4bbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.36.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:05:10.000Z",
      "valid_until": "2026-06-24T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T13:58:02.769Z",
      "x_nadsec_last_seen": "2026-05-23T13:58:03.284Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-23T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--120a2b53-3849-4645-8945-f9272b91e848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.91.45.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:05:10.000Z",
      "valid_until": "2026-06-24T14:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-23T13:35:37.762Z",
      "x_nadsec_last_seen": "2026-05-29T21:41:18.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-23T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1eb22668-b32f-43ac-b32d-e14b1b4ab532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.36.162.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:05:10.000Z",
      "valid_until": "2026-06-24T14:05:09.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-05-23T14:04:14.973Z",
      "x_nadsec_last_seen": "2026-05-30T04:19:53.987Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-23T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f62a915d-1390-4cd3-8aa4-bfc6115e199b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:05:10.000Z",
      "valid_until": "2026-06-24T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T14:07:13.441Z",
      "x_nadsec_last_seen": "2026-05-23T14:07:23.600Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=149178; asn_org=China Telecom; user(top)=**",
      "id": "indicator--b144f23f-1e94-4f04-81ad-3342ef28fd34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.244.24.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:05:10.000Z",
      "valid_until": "2026-06-24T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T06:23:28.146Z",
      "x_nadsec_last_seen": "2026-05-23T14:24:23.495Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "149178"
      ],
      "x_nadsec_orgs": [
        "China Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=267777; asn_org=FUTURE SOLUTIONS DEVELOPMENT SAS; user(top)=**",
      "id": "indicator--be177006-69db-4087-b4da-17aaa3afd897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.171.180.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:05:10.000Z",
      "valid_until": "2026-06-24T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T14:53:34.982Z",
      "x_nadsec_last_seen": "2026-05-23T14:53:34.982Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "267777"
      ],
      "x_nadsec_orgs": [
        "FUTURE SOLUTIONS DEVELOPMENT SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:05:10.000Z",
      "valid_until": "2026-06-24T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T15:04:05.904Z",
      "x_nadsec_last_seen": "2026-05-31T13:50:52.661Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-23T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--34f2322a-8dc2-4070-a150-524823b3f4e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:05:10.000Z",
      "valid_until": "2026-06-24T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T16:51:48.992Z",
      "x_nadsec_last_seen": "2026-05-23T14:31:54.224Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-23T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--cacc92be-4246-4e6e-b42e-9a9b17407671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.187.230.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:05:10.000Z",
      "valid_until": "2026-06-24T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T15:02:36.613Z",
      "x_nadsec_last_seen": "2026-05-23T15:04:43.274Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-23T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=39824; asn_org=JSC Alma Telecommunications",
      "id": "indicator--43c0d21f-b6ac-4030-8b0e-02ad8e2f2791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.134.37.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:05:10.000Z",
      "valid_until": "2026-06-24T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T14:30:49.332Z",
      "x_nadsec_last_seen": "2026-05-23T14:32:56.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "39824"
      ],
      "x_nadsec_orgs": [
        "JSC Alma Telecommunications"
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--87faeae7-0e57-4bd5-bf79-8c1112ea920f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.181.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-23T15:05:40.249Z",
      "x_nadsec_last_seen": "2026-05-23T15:24:40.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=265157; asn_org=MICROTELL SCM LTDA",
      "id": "indicator--0375760b-9b0d-4b4c-a318-aec5c9b1824d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.255.242.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T15:30:52.249Z",
      "x_nadsec_last_seen": "2026-05-23T15:30:59.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265157"
      ],
      "x_nadsec_orgs": [
        "MICROTELL SCM LTDA"
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--7a5d14b8-ece0-4ab2-ad0b-357a59944e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.168.180.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T15:33:33.757Z",
      "x_nadsec_last_seen": "2026-05-23T15:35:39.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T15:06:10.420Z",
      "x_nadsec_last_seen": "2026-05-23T15:06:42.864Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--42008ee7-a7b3-4d47-98b6-9d751b8b2d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.178.82.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T15:37:00.959Z",
      "x_nadsec_last_seen": "2026-05-23T15:39:05.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--d6d4371c-01c8-4692-9ed7-a9b40f2cf052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.93.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T15:58:04.825Z",
      "x_nadsec_last_seen": "2026-05-23T15:58:04.825Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=17444; asn_org=HKBN Enterprise Solutions Limited",
      "id": "indicator--15b92027-fba9-42d6-81be-fb3c29fb06eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.188.21.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T15:15:30.988Z",
      "x_nadsec_last_seen": "2026-05-23T15:15:32.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "17444"
      ],
      "x_nadsec_orgs": [
        "HKBN Enterprise Solutions Limited"
      ]
    },
    {
      "created": "2026-05-23T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BG; asn=211486; asn_org=Alferov Aleksey Aleksandrovich",
      "id": "indicator--7e8f6048-be0e-4049-bdc6-61191beee7c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.152.208.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:05:10.000Z",
      "valid_until": "2026-06-24T16:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-21T13:54:36.269Z",
      "x_nadsec_last_seen": "2026-05-30T10:17:35.238Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "211486"
      ],
      "x_nadsec_orgs": [
        "Alferov Aleksey Aleksandrovich"
      ]
    },
    {
      "created": "2026-05-23T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--7a8b7f78-395b-453b-b607-395f62949d4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.253.243.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:05:10.000Z",
      "valid_until": "2026-06-24T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T16:53:17.875Z",
      "x_nadsec_last_seen": "2026-05-23T16:53:17.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-23T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--6e01bb22-777c-4b1d-8589-fb09915670ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.88.147.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:05:10.000Z",
      "valid_until": "2026-06-24T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T16:19:18.882Z",
      "x_nadsec_last_seen": "2026-05-23T16:21:25.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-23T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--ad55c147-bb61-4bba-8854-4a1c31860a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:05:10.000Z",
      "valid_until": "2026-06-24T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T16:09:48.463Z",
      "x_nadsec_last_seen": "2026-05-23T16:09:48.463Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-05-23T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=265586; asn_org=INBTEL SA DE CV",
      "id": "indicator--74432ead-4569-4fa9-a91b-49fe7421283d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.175.233.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:05:10.000Z",
      "valid_until": "2026-06-24T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T16:20:45.511Z",
      "x_nadsec_last_seen": "2026-05-23T16:22:50.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265586"
      ],
      "x_nadsec_orgs": [
        "INBTEL SA DE CV"
      ]
    },
    {
      "created": "2026-05-23T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4dbcc8e3-a6b8-4bfb-a7df-77516d36d539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:05:10.000Z",
      "valid_until": "2026-06-24T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T16:19:36.493Z",
      "x_nadsec_last_seen": "2026-05-23T16:19:55.671Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-23T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=147131; asn_org=PT Global Sarana Elektronika",
      "id": "indicator--0eeed96a-f58e-4c61-bbd4-1772c649efad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.96.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:05:10.000Z",
      "valid_until": "2026-06-24T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T17:11:26.247Z",
      "x_nadsec_last_seen": "2026-05-23T17:17:39.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "147131"
      ],
      "x_nadsec_orgs": [
        "PT Global Sarana Elektronika"
      ]
    },
    {
      "created": "2026-05-23T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--eca3f473-bb2c-4c29-8948-14ba01307b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.238.46.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:05:10.000Z",
      "valid_until": "2026-06-24T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T18:00:35.466Z",
      "x_nadsec_last_seen": "2026-05-23T18:00:41.149Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-23T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31566; asn_org=SkyNetwork Ltd.",
      "id": "indicator--74d4117c-8a89-4ce7-b299-52f33a9419a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.128.96.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:05:10.000Z",
      "valid_until": "2026-06-24T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T17:05:15.673Z",
      "x_nadsec_last_seen": "2026-05-23T17:05:15.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31566"
      ],
      "x_nadsec_orgs": [
        "SkyNetwork Ltd."
      ]
    },
    {
      "created": "2026-05-23T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b35f1435-424a-4782-8cca-fe0560996fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:05:10.000Z",
      "valid_until": "2026-06-24T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T17:15:14.890Z",
      "x_nadsec_last_seen": "2026-05-23T17:15:14.890Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--d00bcbdc-bf16-49e3-b2dd-eb60d185cd89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.91.105.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T19:00:04.511Z",
      "x_nadsec_last_seen": "2026-05-23T19:02:12.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mysqld; ports=3306; cc=US; asn=54600; asn_org=PEG TECH INC; user(top)=r**t",
      "id": "indicator--72f700e8-1f22-44d6-a6ec-60ee5f8d9d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.233.214.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-05-23T18:36:42.766Z",
      "x_nadsec_last_seen": "2026-05-24T16:02:02.646Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "54600"
      ],
      "x_nadsec_orgs": [
        "PEG TECH INC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ba0d0e8a-0c03-4c0d-b361-02baa5ede85c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.16.3.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T18:30:48.997Z",
      "x_nadsec_last_seen": "2026-05-23T18:32:53.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1d161537-1cc4-4cf3-89b7-77279914a060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T18:24:30.226Z",
      "x_nadsec_last_seen": "2026-05-23T18:24:40.401Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=57800; asn_org=Cadr-TV LLE TVRC",
      "id": "indicator--fb586071-7661-4ce8-a53d-6ac7457f84ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.108.25.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T18:50:36.648Z",
      "x_nadsec_last_seen": "2026-05-23T18:52:43.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "57800"
      ],
      "x_nadsec_orgs": [
        "Cadr-TV LLE TVRC"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--c6700172-0805-4fbc-83a6-e59f5c36adc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.2.108.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T18:42:13.792Z",
      "x_nadsec_last_seen": "2026-05-23T18:49:47.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.; user(top)=**",
      "id": "indicator--6777e47a-461d-4a1f-a83f-04da6f325202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.78.234.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T18:29:28.670Z",
      "x_nadsec_last_seen": "2026-05-23T18:29:28.670Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--944798ea-70d3-44b4-8f4f-fb82518f9be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.1.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T18:46:36.028Z",
      "x_nadsec_last_seen": "2026-05-23T18:46:36.028Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--de3ca551-9fe9-4757-a418-35c278eb9989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.126.237.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T19:03:16.930Z",
      "x_nadsec_last_seen": "2026-05-29T10:08:43.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--87a3213e-25af-4e21-b067-f874c51a8ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.38.201.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T19:00:20.556Z",
      "x_nadsec_last_seen": "2026-05-28T12:06:02.385Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-23T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RO; asn=214295; asn_org=Skynet Network Ltd",
      "id": "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:05:11.000Z",
      "valid_until": "2026-06-24T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T18:13:13.014Z",
      "x_nadsec_last_seen": "2026-05-23T18:13:13.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "214295"
      ],
      "x_nadsec_orgs": [
        "Skynet Network Ltd"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=136902; asn_org=Alegra Communication Private Limited",
      "id": "indicator--cdd0ffcb-e68d-4dec-acce-9f9d5b0fce43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.98.85.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T20:02:03.958Z",
      "x_nadsec_last_seen": "2026-05-23T20:04:08.756Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136902"
      ],
      "x_nadsec_orgs": [
        "Alegra Communication Private Limited"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--f4ab30ac-c3e2-47b3-b7b2-e6a0de00b0ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T19:20:32.268Z",
      "x_nadsec_last_seen": "2026-05-23T19:20:32.268Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--faea1960-6ae2-401c-8778-4d2158b888b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T21:10:45.157Z",
      "x_nadsec_last_seen": "2026-05-23T19:20:08.745Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--6c45718e-19b0-480c-9c2f-519b668c3581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-05-22T21:10:30.706Z",
      "x_nadsec_last_seen": "2026-05-24T09:59:33.235Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--b7cf0b04-c137-4499-89eb-a21e8f2cccb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T21:10:53.279Z",
      "x_nadsec_last_seen": "2026-05-23T19:19:47.549Z",
      "x_nadsec_ports": [
        "135",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--95c54c80-27b0-460e-9bd0-0e0c58d497b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-22T21:10:36.814Z",
      "x_nadsec_last_seen": "2026-05-23T19:20:37.269Z",
      "x_nadsec_ports": [
        "1433",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e29dc1cb-036b-448b-998b-1dc9498b66f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.223.93.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T19:10:09.276Z",
      "x_nadsec_last_seen": "2026-05-23T19:10:09.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--5e47744d-71cd-485a-869b-c950e19d256c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.173.73.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T19:37:12.635Z",
      "x_nadsec_last_seen": "2026-05-23T19:39:19.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b323199b-20de-40e7-a73c-790991d7b8c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.199.77.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T19:51:40.680Z",
      "x_nadsec_last_seen": "2026-05-23T19:51:51.970Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1560312f-18a7-4878-afbe-0ac38513e21c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T19:22:51.534Z",
      "x_nadsec_last_seen": "2026-05-23T19:23:01.694Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6128; asn_org=Cablevision Systems Corp.",
      "id": "indicator--9263dbcc-c58a-478a-888b-7593e7b6a650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '63.247.183.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-23T20:00:25.084Z",
      "x_nadsec_last_seen": "2026-05-25T12:51:48.405Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6128"
      ],
      "x_nadsec_orgs": [
        "Cablevision Systems Corp."
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d6597bb7-cd7b-4152-b93e-8e9248f32004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.131.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T19:51:53.532Z",
      "x_nadsec_last_seen": "2026-05-23T19:51:53.532Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6953c798-9c1d-4d2c-a8f6-8a0adb5fdf8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T19:22:16.476Z",
      "x_nadsec_last_seen": "2026-05-23T19:22:16.476Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--be04646b-6c6f-4e15-afb8-1a0d3356681c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T19:21:53.589Z",
      "x_nadsec_last_seen": "2026-05-23T19:21:53.589Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--12eaf260-9f9e-44bb-81b2-7c0c4c0a9cbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T19:22:15.762Z",
      "x_nadsec_last_seen": "2026-05-23T19:22:15.762Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-23T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--57b554cc-c9ef-40ff-a77f-d0a066143741",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:05:10.000Z",
      "valid_until": "2026-06-24T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T19:21:53.979Z",
      "x_nadsec_last_seen": "2026-05-23T19:21:53.979Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-23T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--754cde3f-1810-4252-8bf4-5903d84c57ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.227.71.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:05:10.000Z",
      "valid_until": "2026-06-24T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T20:35:36.774Z",
      "x_nadsec_last_seen": "2026-05-23T20:37:41.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-23T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=NL; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--2ee1ec7f-3580-49f0-895f-61e941354f57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.117.183.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:05:10.000Z",
      "valid_until": "2026-06-24T21:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-23T20:58:05.007Z",
      "x_nadsec_last_seen": "2026-05-28T09:02:37.308Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--267d931b-ab95-4126-b630-568f3b0acf7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.180.234.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:05:10.000Z",
      "valid_until": "2026-06-24T21:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-23T20:56:22.602Z",
      "x_nadsec_last_seen": "2026-05-24T00:17:30.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ec7a6f7a-9117-471d-9058-82fd2d0b6ff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.170.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:05:10.000Z",
      "valid_until": "2026-06-24T21:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-23T20:56:22.446Z",
      "x_nadsec_last_seen": "2026-05-24T00:17:29.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b7a74899-e753-4b38-90fa-e9c489fb95d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.197.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:05:10.000Z",
      "valid_until": "2026-06-24T21:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-23T20:19:32.626Z",
      "x_nadsec_last_seen": "2026-05-23T20:20:31.042Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--098aabd6-b86b-466b-aa7d-0e062b385411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.150.16.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T21:05:10.000Z",
      "valid_until": "2026-06-24T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T21:04:12.638Z",
      "x_nadsec_last_seen": "2026-05-23T21:04:12.638Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=24445; asn_org=Henan Mobile Communications Co.,Ltd; user(top)=**",
      "id": "indicator--b6bc0b8a-a51c-48be-b08c-2132e069e972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.158.66.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:05:11.000Z",
      "valid_until": "2026-06-24T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T21:53:52.345Z",
      "x_nadsec_last_seen": "2026-05-29T17:05:49.800Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24445"
      ],
      "x_nadsec_orgs": [
        "Henan Mobile Communications Co.,Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--da4e55ce-1674-4623-9322-bf9beb49fdad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.25.30.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:05:11.000Z",
      "valid_until": "2026-06-24T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T21:51:36.382Z",
      "x_nadsec_last_seen": "2026-05-23T21:51:41.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DE; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--e35d96e5-4ce7-4ce0-a6a7-0e52748a716d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.67.81.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:05:11.000Z",
      "valid_until": "2026-06-24T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T21:34:53.691Z",
      "x_nadsec_last_seen": "2026-05-30T23:49:52.098Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-23T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PA; asn=11556; asn_org=Cable & Wireless Panama",
      "id": "indicator--1656a18a-ac15-45d4-ada9-c47c44398bf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.178.248.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:05:11.000Z",
      "valid_until": "2026-06-24T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T21:57:20.167Z",
      "x_nadsec_last_seen": "2026-05-23T21:57:25.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "11556"
      ],
      "x_nadsec_orgs": [
        "Cable & Wireless Panama"
      ]
    },
    {
      "created": "2026-05-23T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--913a907d-94c0-4c7f-84ec-a58f4b370772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.161.24.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:05:11.000Z",
      "valid_until": "2026-06-24T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T21:42:26.685Z",
      "x_nadsec_last_seen": "2026-05-23T21:44:32.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-23T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--92f829fc-510e-4280-b802-c6c9d0f30a7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.76.58.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:05:11.000Z",
      "valid_until": "2026-06-24T22:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-23T21:21:56.564Z",
      "x_nadsec_last_seen": "2026-05-30T01:20:24.317Z",
      "x_nadsec_ports": [
        "3306",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-05-23T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7e4a4853-1bcb-46c4-b447-75ab9dea407f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.238.86.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:05:05.000Z",
      "valid_until": "2026-06-24T23:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T23:02:20.548Z",
      "x_nadsec_last_seen": "2026-05-23T23:02:25.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-23T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--11eee336-340f-4df6-ba50-a8464d0593a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.80.188.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:05:05.000Z",
      "valid_until": "2026-06-24T23:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T22:18:02.245Z",
      "x_nadsec_last_seen": "2026-05-23T22:24:17.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-23T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--3a7c8631-a04d-4b6f-bead-23f21a724ea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.228.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:05:05.000Z",
      "valid_until": "2026-06-24T23:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-23T22:53:30.155Z",
      "x_nadsec_last_seen": "2026-05-23T22:55:37.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-23T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9c6f72fb-fd34-42bd-87b2-3436e0c8035e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:05:05.000Z",
      "valid_until": "2026-06-24T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T22:16:03.203Z",
      "x_nadsec_last_seen": "2026-05-23T22:16:03.203Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--23ff6d08-ef8c-4576-af32-ef94939ba063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.29.57.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:05:05.000Z",
      "valid_until": "2026-06-24T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T22:31:14.552Z",
      "x_nadsec_last_seen": "2026-05-23T22:31:14.552Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-23T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133255; asn_org=Elxer Communications Private Limited",
      "id": "indicator--e40b8e6b-ba12-4211-91e5-c8b7ee0bc5a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.124.145.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:05:05.000Z",
      "valid_until": "2026-06-24T23:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-23T22:29:06.066Z",
      "x_nadsec_last_seen": "2026-05-23T22:35:09.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133255"
      ],
      "x_nadsec_orgs": [
        "Elxer Communications Private Limited"
      ]
    },
    {
      "created": "2026-05-23T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5c0ae7a1-8fc2-4c24-a3e8-10685b7518f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-23T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.180.145.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T23:05:05.000Z",
      "valid_until": "2026-06-24T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T22:56:58.845Z",
      "x_nadsec_last_seen": "2026-05-23T22:56:58.845Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T00:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--291fac0c-da64-417e-9683-10f5751fcff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:05:06.000Z",
      "valid_until": "2026-06-25T00:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T00:01:48.341Z",
      "x_nadsec_last_seen": "2026-05-26T09:50:09.436Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-05-24T00:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6cebaf16-1691-4c8c-9820-3cee885ddfb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:05:06.000Z",
      "valid_until": "2026-06-25T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-23T23:33:02.450Z",
      "x_nadsec_last_seen": "2026-05-23T23:33:02.450Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T00:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b79f2bc3-1cd2-43a9-a025-f0d6da7b27f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:05:06.000Z",
      "valid_until": "2026-06-25T00:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-23T23:13:47.457Z",
      "x_nadsec_last_seen": "2026-05-25T23:08:30.090Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T00:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2a56b7d1-753c-412b-af2d-ecfcd798fedc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T00:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.55.90.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:05:06.000Z",
      "valid_until": "2026-06-25T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T00:03:45.525Z",
      "x_nadsec_last_seen": "2026-05-24T00:03:45.525Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--657605a8-501f-4029-bc59-ae6a35ef679f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.64.41.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T00:52:44.643Z",
      "x_nadsec_last_seen": "2026-05-24T00:54:49.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b4131dcb-ce5a-426a-98f6-60bcadc1793d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.128.145.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T00:05:00.643Z",
      "x_nadsec_last_seen": "2026-05-24T00:12:21.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f2875ea2-504b-463f-98b2-dfd42c328938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.112.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T00:20:14.385Z",
      "x_nadsec_last_seen": "2026-05-24T00:22:19.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--7dc29108-c3b3-4d15-9b1e-e488b2d19510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.30.83.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T00:15:56.872Z",
      "x_nadsec_last_seen": "2026-05-24T00:18:03.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--905d6742-721a-430b-a28b-1dea79c0eb3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '174.129.147.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T01:00:20.737Z",
      "x_nadsec_last_seen": "2026-05-24T01:00:20.737Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--90899434-d377-4f45-9cb5-a4df23bf1e45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T00:51:19.797Z",
      "x_nadsec_last_seen": "2026-05-24T00:51:19.797Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--75677e55-2a7d-4c11-a9c7-77b5a168a179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.40.218.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T00:07:16.209Z",
      "x_nadsec_last_seen": "2026-05-30T06:01:49.969Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=10029; asn_org=SHYAM SPECTRA PVT LTD",
      "id": "indicator--2be83fb0-0638-4b62-a71f-13123e5744c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.92.35.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T00:06:31.802Z",
      "x_nadsec_last_seen": "2026-05-24T00:09:43.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "10029"
      ],
      "x_nadsec_orgs": [
        "SHYAM SPECTRA PVT LTD"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=207043; asn_org=Dedik Services Limited",
      "id": "indicator--f93ee57d-318d-425d-bef4-28b3b22ccf82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.94.145.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T00:05:43.639Z",
      "x_nadsec_last_seen": "2026-05-24T13:15:52.625Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "207043"
      ],
      "x_nadsec_orgs": [
        "Dedik Services Limited"
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-14T11:20:06.192Z",
      "x_nadsec_last_seen": "2026-05-28T19:36:06.060Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-24T01:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--3eed58cc-ee7f-436d-8283-02d894b69b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T01:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:05:11.000Z",
      "valid_until": "2026-06-25T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T00:57:51.333Z",
      "x_nadsec_last_seen": "2026-05-24T00:57:51.333Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=IN; asn=56272; asn_org=Pulse Telesystems Pvt Ltd",
      "id": "indicator--fae62f13-087c-4606-871d-e2af03aa87cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.249.204.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-24T01:30:14.328Z",
      "x_nadsec_last_seen": "2026-05-24T02:03:25.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "56272"
      ],
      "x_nadsec_orgs": [
        "Pulse Telesystems Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--abceb5ed-6dae-4047-a40d-4cdfbb4392dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.221.13.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-05-24T02:00:14.390Z",
      "x_nadsec_last_seen": "2026-05-31T02:20:21.130Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=60729; asn_org=Stiftung Erneuerbare Freiheit",
      "id": "indicator--62c63aa0-5daf-4e6a-a92b-3390bdbc821e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T01:16:31.455Z",
      "x_nadsec_last_seen": "2026-05-24T01:16:31.455Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "60729"
      ],
      "x_nadsec_orgs": [
        "Stiftung Erneuerbare Freiheit"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=60729; asn_org=Stiftung Erneuerbare Freiheit",
      "id": "indicator--75c35b69-8804-48b8-bf78-a92f7aefd337",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T01:16:58.121Z",
      "x_nadsec_last_seen": "2026-05-24T01:16:58.121Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "60729"
      ],
      "x_nadsec_orgs": [
        "Stiftung Erneuerbare Freiheit"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c4d874a3-0f0f-4df1-95ab-108ae1d65f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.254.158.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T01:55:50.219Z",
      "x_nadsec_last_seen": "2026-05-24T01:57:54.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--3a82dc28-9929-44c8-acce-04f03cc1bf4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:17:32.179Z",
      "x_nadsec_last_seen": "2026-05-24T01:17:32.917Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--a2286a3d-dc47-484f-a677-9fcba1d5c9cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T01:17:42.953Z",
      "x_nadsec_last_seen": "2026-05-24T01:17:54.574Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--c20f3ec1-942f-42d3-8e92-c76d6ed449fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:19:20.295Z",
      "x_nadsec_last_seen": "2026-05-24T01:19:21.087Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--b11fb7ed-b8cc-4759-9591-d627e0ed27b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T01:17:09.823Z",
      "x_nadsec_last_seen": "2026-05-24T01:17:22.193Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--dc9d76fe-1212-42ef-840d-d826cd375420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:18:47.711Z",
      "x_nadsec_last_seen": "2026-05-24T01:18:48.487Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--81f963c2-5075-4433-88e9-356671cba817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T01:19:31.079Z",
      "x_nadsec_last_seen": "2026-05-24T01:19:31.079Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--a379b40b-faac-4c4f-9d66-50cfb32f4dd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:18:26.212Z",
      "x_nadsec_last_seen": "2026-05-24T01:18:26.960Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--c279316e-5dcd-41d1-9fc8-11b90d16014c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:18:15.408Z",
      "x_nadsec_last_seen": "2026-05-24T01:18:16.209Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--e81cfc86-c791-465e-b5db-05d09ea3859a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:18:04.592Z",
      "x_nadsec_last_seen": "2026-05-24T01:18:05.394Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--09905267-f0c5-4db2-9495-5b03e85b403c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:16:59.068Z",
      "x_nadsec_last_seen": "2026-05-24T01:16:59.811Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--ca09eb97-50aa-43d7-989d-7c7bae0947e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:18:36.963Z",
      "x_nadsec_last_seen": "2026-05-24T01:18:37.705Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=10029; asn_org=SHYAM SPECTRA PVT LTD; user(top)=**",
      "id": "indicator--f02b5344-67dc-45f5-b2a4-3db9fab600ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.122.7.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T01:30:51.081Z",
      "x_nadsec_last_seen": "2026-05-24T01:30:51.081Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "10029"
      ],
      "x_nadsec_orgs": [
        "SHYAM SPECTRA PVT LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T01:18:58.564Z",
      "x_nadsec_last_seen": "2026-05-24T01:19:10.343Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-05-24T02:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=BG; asn=34224; asn_org=Neterra Ltd.",
      "id": "indicator--3d64c3e6-8bd5-492d-950d-33e566480fe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T02:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.92.109.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:05:06.000Z",
      "valid_until": "2026-06-25T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T01:16:41.466Z",
      "x_nadsec_last_seen": "2026-05-24T01:16:42.334Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "34224"
      ],
      "x_nadsec_orgs": [
        "Neterra Ltd."
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--c63b49a5-0fca-4fe2-886f-22f94a14235d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.24.16.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T02:44:32.655Z",
      "x_nadsec_last_seen": "2026-05-24T02:44:32.655Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=24378; asn_org=Total Access Communication PLC.",
      "id": "indicator--d0591376-9989-4532-a1ed-a4cfb8a0a5a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.47.217.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T02:14:22.462Z",
      "x_nadsec_last_seen": "2026-05-24T02:16:27.893Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "24378"
      ],
      "x_nadsec_orgs": [
        "Total Access Communication PLC."
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b2752d6f-5751-47d7-acbe-ae8f45567859",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.249.60.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T02:44:24.851Z",
      "x_nadsec_last_seen": "2026-05-24T02:44:24.851Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--68894c15-fd89-4d5d-8074-a56cb0c3d207",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.177.181.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T02:44:57.842Z",
      "x_nadsec_last_seen": "2026-05-24T02:44:57.842Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--b3b9b88c-52aa-4609-ad1f-1e5b1f43cef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.7.236.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T02:29:55.972Z",
      "x_nadsec_last_seen": "2026-05-24T02:32:01.295Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--fd0c4b2b-dd0d-4f4d-903b-59071f568323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.58.233.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T02:41:30.415Z",
      "x_nadsec_last_seen": "2026-05-24T02:47:44.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a940a6ca-b9a9-44a0-a5e1-0118dabdb390",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.245.84.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T02:45:04.858Z",
      "x_nadsec_last_seen": "2026-05-24T02:45:04.858Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--c169737a-420f-457a-835e-da0c4a42dfec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-24T02:27:11.051Z",
      "x_nadsec_last_seen": "2026-05-24T02:28:51.332Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--d8823cba-f962-44d8-82f0-163892b8b968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T02:27:45.171Z",
      "x_nadsec_last_seen": "2026-05-24T02:28:10.607Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--d3985724-15c7-4df4-8e78-06e5e46e325f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T02:27:35.133Z",
      "x_nadsec_last_seen": "2026-05-24T02:28:40.797Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--dabda9fa-e838-455e-9176-8b16fa9bed0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T02:27:11.573Z",
      "x_nadsec_last_seen": "2026-05-24T02:28:20.518Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--85eb0d85-ed01-4aaf-9841-659e44a46987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T02:22:34.906Z",
      "x_nadsec_last_seen": "2026-05-24T02:22:34.906Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f0eaddf1-0cc5-43de-9ffa-b5ee2d67531d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T03:02:54.799Z",
      "x_nadsec_last_seen": "2026-05-24T03:02:55.123Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--23355fdd-7290-46f4-831b-ca55e06efd27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.197.78.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T02:44:40.691Z",
      "x_nadsec_last_seen": "2026-05-24T02:44:40.691Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-24T03:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--4c2a55e2-f4a4-495b-ac07-05b158fbcc67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T03:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:05:06.000Z",
      "valid_until": "2026-06-25T03:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T02:44:51.727Z",
      "x_nadsec_last_seen": "2026-05-24T02:44:51.727Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fe8add4d-5784-4e51-a9d6-4e4b171ad5b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.37.140.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T03:59:31.139Z",
      "x_nadsec_last_seen": "2026-05-24T04:06:11.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--56102ce5-e2c8-4732-bd8c-bc0fa95df6a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.232.80.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T04:00:06.986Z",
      "x_nadsec_last_seen": "2026-05-24T04:00:07.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d97cfaae-043f-43ab-a42b-19e42ca16c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.191.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T03:18:07.126Z",
      "x_nadsec_last_seen": "2026-05-24T03:18:10.436Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8053; asn_org=IFX Networks Venezuela C.A.",
      "id": "indicator--7ca1c572-748d-49bd-986f-be89393192ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.225.50.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T03:35:46.021Z",
      "x_nadsec_last_seen": "2026-05-24T03:42:42.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8053"
      ],
      "x_nadsec_orgs": [
        "IFX Networks Venezuela C.A."
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--d77d821f-62c1-48cb-904f-1f532d63861d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.69.179.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T03:27:22.640Z",
      "x_nadsec_last_seen": "2026-05-24T03:29:27.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--c7817c03-895e-4158-93dd-7908db6194c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.150.32.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T03:09:04.279Z",
      "x_nadsec_last_seen": "2026-05-24T03:09:04.279Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--943cc5a4-5f55-4b76-9a2d-613d17e7e6ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.102.97.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T03:08:47.913Z",
      "x_nadsec_last_seen": "2026-05-24T03:08:47.913Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=6306; asn_org=TELEFONICA VENEZOLANA, C.A.",
      "id": "indicator--07b6b110-3eca-4d19-87d8-77747bbf9901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.35.94.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-24T03:36:38.587Z",
      "x_nadsec_last_seen": "2026-05-24T13:20:11.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "6306"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA VENEZOLANA, C.A."
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--798a1a8f-1b72-4c8b-800e-8c15455afc38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.53.192.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-24T03:16:20.809Z",
      "x_nadsec_last_seen": "2026-05-31T09:40:43.546Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@",
        ""
      ]
    },
    {
      "created": "2026-05-24T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--360150f3-dc9a-44fe-a9ef-dac208d45e95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.103.243.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:05:10.000Z",
      "valid_until": "2026-06-25T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T03:46:55.854Z",
      "x_nadsec_last_seen": "2026-05-24T03:47:01.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8d0b92d9-c2ea-4253-840d-a8b38f8ef340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T05:02:42.756Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:42.756Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T05:02:47.764Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:47.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--89fd0d76-c92b-4747-adb1-e93c02929b1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T05:02:32.554Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:56.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--4aa2dcfb-f640-486d-ada9-49347e2c9343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T05:02:00.553Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:24.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--66c47865-1184-41a5-9814-e6c8a8e7b403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T05:02:36.045Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:57.994Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T05:01:58.455Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:45.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--63c85f5f-f8f3-470e-86f6-8c5d5e8d4ca7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T05:02:06.831Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:47.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-24T05:02:08.527Z",
      "x_nadsec_last_seen": "2026-05-31T15:16:11.472Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--27720235-27d3-4957-a0d2-d843eed19eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T05:02:14.117Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:49.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--a7b098e2-bf19-4ba1-88d2-b4099ae759b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T05:02:30.201Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:30.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T05:02:02.298Z",
      "x_nadsec_last_seen": "2026-05-24T05:02:27.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--39b580bb-1677-49b9-9991-65360781772a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.200.76.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T04:11:45.884Z",
      "x_nadsec_last_seen": "2026-05-24T04:11:45.884Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--5645b373-d019-45da-94a8-439f47919e91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.195.10.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T04:08:31.706Z",
      "x_nadsec_last_seen": "2026-05-24T04:10:37.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c3bbda8d-6e70-471d-853e-14cc7faf95de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.209.25.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T04:13:06.318Z",
      "x_nadsec_last_seen": "2026-05-24T04:15:12.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--c5646c53-73e2-4f70-8d4d-d083ddedc8ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.54.59.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T04:31:47.946Z",
      "x_nadsec_last_seen": "2026-05-24T04:33:54.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--ed559cfb-bf09-4f8f-974d-13b2503f339c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.129.164.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T05:04:34.618Z",
      "x_nadsec_last_seen": "2026-05-24T05:04:34.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1657dd8a-aeaf-4ffd-b253-6ba770f435bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T04:14:29.799Z",
      "x_nadsec_last_seen": "2026-05-24T04:14:29.799Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T04:28:13.392Z",
      "x_nadsec_last_seen": "2026-05-24T04:28:14.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=TW; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--ef90d881-5946-42e1-8149-437c96afe7ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T04:22:31.066Z",
      "x_nadsec_last_seen": "2026-05-24T04:22:31.066Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--793b180a-0ae5-4554-ab4b-14c229df46d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.69.174.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T05:02:27.506Z",
      "x_nadsec_last_seen": "2026-05-24T05:06:35.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-24T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AE; asn=15802; asn_org=Emirates Integrated Telecommunications Company PJSC",
      "id": "indicator--7de1d4cc-0c37-4020-9a72-05d61cd8372e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.73.90.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:05:10.000Z",
      "valid_until": "2026-06-25T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T05:02:55.095Z",
      "x_nadsec_last_seen": "2026-05-24T05:05:02.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "15802"
      ],
      "x_nadsec_orgs": [
        "Emirates Integrated Telecommunications Company PJSC"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--3ea0fa75-9780-431f-9cfb-77f1686b62a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.155.104.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T05:48:15.999Z",
      "x_nadsec_last_seen": "2026-05-24T05:48:15.999Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--14837275-5f9c-477f-b737-3633191c83d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.3.164.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T05:20:14.963Z",
      "x_nadsec_last_seen": "2026-05-24T05:20:15.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7352feff-91ad-4bf0-82ce-2524933a4092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.197.90.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-24T05:27:08.999Z",
      "x_nadsec_last_seen": "2026-05-24T06:30:36.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--50fa8c54-6196-4e46-8e79-dc8f7a168a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.228.164.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T05:51:38.255Z",
      "x_nadsec_last_seen": "2026-05-24T05:53:45.709Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T05:05:57.776Z",
      "x_nadsec_last_seen": "2026-05-24T05:05:57.776Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--95053c99-e110-45f9-b28f-95102538951d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.22.117.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T05:53:08.185Z",
      "x_nadsec_last_seen": "2026-05-24T05:55:13.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--fb9a7c41-026c-473c-8175-75772b44bb2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.38.37.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T05:48:26.907Z",
      "x_nadsec_last_seen": "2026-05-24T05:49:16.184Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d718d51e-92df-45ac-942e-da782aa63a5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.74.225.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T05:04:31.372Z",
      "x_nadsec_last_seen": "2026-05-24T05:06:36.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-24T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--e479a962-6e02-4b74-b560-0b665b0baf4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.145.92.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:05:11.000Z",
      "valid_until": "2026-06-25T06:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-24T05:49:12.895Z",
      "x_nadsec_last_seen": "2026-05-30T07:45:10.860Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IQ; asn=203214; asn_org=Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "id": "indicator--656d2713-5f73-4fbb-ab14-4afce75e01df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.224.17.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T06:41:07.748Z",
      "x_nadsec_last_seen": "2026-05-24T06:41:07.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "203214"
      ],
      "x_nadsec_orgs": [
        "Hulum Almustakbal Company for Communication Engineering and Services Ltd"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c67de16c-4136-4f86-9996-6ca1da65edb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.171.211.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T06:11:08.889Z",
      "x_nadsec_last_seen": "2026-05-24T06:13:13.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f53ff56b-612b-4dab-a1dd-5d10dff6a94b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.190.39.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T06:11:21.188Z",
      "x_nadsec_last_seen": "2026-05-24T06:11:21.188Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c301a53a-d70c-4524-afd6-ec3ca30514c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.7.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T06:55:42.609Z",
      "x_nadsec_last_seen": "2026-05-24T11:31:35.067Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5d8bbebd-b3f9-4380-8921-9c82603a21cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-24T06:41:09.955Z",
      "x_nadsec_last_seen": "2026-05-24T06:42:10.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0c4e4b95-9be0-4884-af20-23dc7ad82597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.11.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T06:55:41.551Z",
      "x_nadsec_last_seen": "2026-05-24T06:55:41.551Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31430; asn_org=OOO Suntel",
      "id": "indicator--6c532d10-50cc-40fd-9d37-8a59bf75b4c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.126.45.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T06:32:14.978Z",
      "x_nadsec_last_seen": "2026-05-24T06:34:21.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31430"
      ],
      "x_nadsec_orgs": [
        "OOO Suntel"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262606; asn_org=MICROTELL SCM LTDA",
      "id": "indicator--19fe9573-5fba-4411-8bb7-4ea9dbd46e30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.101.37.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T06:26:56.143Z",
      "x_nadsec_last_seen": "2026-05-24T06:29:03.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262606"
      ],
      "x_nadsec_orgs": [
        "MICROTELL SCM LTDA"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--14b48af7-2323-4c85-a214-d8aa80ab00a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.155.43.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T06:39:18.573Z",
      "x_nadsec_last_seen": "2026-05-24T06:41:23.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--8da1356f-4406-4248-ab06-a16261212a72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.120.234.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T06:59:27.509Z",
      "x_nadsec_last_seen": "2026-05-24T07:06:26.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4772bec6-5edc-4e44-bf5f-521c7c664e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T06:48:09.005Z",
      "x_nadsec_last_seen": "2026-05-26T21:40:31.020Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a1eeead4-29be-4e2b-9f21-60c3723a5b88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.221.30.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T06:11:31.080Z",
      "x_nadsec_last_seen": "2026-05-24T06:11:59.547Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c4f59b7b-096f-4ab0-b9d3-00d2ed8291f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.249.178.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-24T06:29:32.171Z",
      "x_nadsec_last_seen": "2026-05-24T07:01:28.618Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f69fe1e7-2ec3-4bfd-8a9f-90bf9eb46903",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.70.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T07:05:11.000Z",
      "valid_until": "2026-06-25T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T06:24:46.844Z",
      "x_nadsec_last_seen": "2026-05-24T06:25:11.229Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--2c015e09-3d09-4211-9227-56aebdec011e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.233.131.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-24T07:38:21.723Z",
      "x_nadsec_last_seen": "2026-05-28T21:45:22.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--ec35dca1-8381-4593-bf02-605127ce2471",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.171.92.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T07:53:39.279Z",
      "x_nadsec_last_seen": "2026-05-24T07:53:39.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1fbf9b64-f9dc-4072-a1e1-bd674db6c3c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.227.160.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T07:13:51.619Z",
      "x_nadsec_last_seen": "2026-05-24T07:13:56.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--919b61de-7bd9-477f-be2e-df1b1d77f8b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T07:26:37.756Z",
      "x_nadsec_last_seen": "2026-05-24T07:27:07.757Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=265594; asn_org=Television Internacional, S.A. de C.V.",
      "id": "indicator--406bbe5b-a81d-4986-9e37-c7dc4ea1aff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.218.8.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-24T08:02:59.862Z",
      "x_nadsec_last_seen": "2026-05-24T08:59:38.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265594"
      ],
      "x_nadsec_orgs": [
        "Television Internacional, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f70d4daa-7a48-43f4-9001-9d445bde0e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.21.251.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T08:01:13.914Z",
      "x_nadsec_last_seen": "2026-05-24T08:03:18.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--fa2dd6ae-77d3-4934-a6d8-b81afb649638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.1.221.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T07:08:07.494Z",
      "x_nadsec_last_seen": "2026-05-24T07:08:12.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=9304; asn_org=HGC Global Communications Limited",
      "id": "indicator--9e2be11b-c40d-42f6-8e07-b11ea57c0223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.18.59.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T07:10:30.338Z",
      "x_nadsec_last_seen": "2026-05-24T07:12:36.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9304"
      ],
      "x_nadsec_orgs": [
        "HGC Global Communications Limited"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b6400d11-625e-4761-a8f8-2d5e9422d107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.16.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T07:19:03.880Z",
      "x_nadsec_last_seen": "2026-05-24T07:26:06.627Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--adace7ec-4009-4d43-9fc8-17b4fe72ede1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.98.9.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T07:26:08.676Z",
      "x_nadsec_last_seen": "2026-05-24T07:28:14.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4f547501-a959-443b-b686-59ab8c5d0f83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T07:31:09.557Z",
      "x_nadsec_last_seen": "2026-05-24T07:31:09.557Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-24T08:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ecf41038-89da-4510-b90a-1f5fe53209d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T08:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T08:05:11.000Z",
      "valid_until": "2026-06-25T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T07:31:09.975Z",
      "x_nadsec_last_seen": "2026-05-24T07:31:09.975Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-24T09:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=140003; asn_org=Rumah Sakit Umum Pusat DR Hasan Sadikin",
      "id": "indicator--514e94fd-9189-4bfe-928b-1e9450372f12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.148.194.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:06:31.000Z",
      "valid_until": "2026-06-25T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T08:12:56.220Z",
      "x_nadsec_last_seen": "2026-05-24T08:13:00.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140003"
      ],
      "x_nadsec_orgs": [
        "Rumah Sakit Umum Pusat DR Hasan Sadikin"
      ]
    },
    {
      "created": "2026-05-24T09:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--623b794e-b9ce-4aa3-9739-cd3ebedb4613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.155.76.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:06:31.000Z",
      "valid_until": "2026-06-25T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T08:05:33.032Z",
      "x_nadsec_last_seen": "2026-05-24T08:07:41.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-05-24T09:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--f3cb734e-9ee8-420d-8cbc-dd1a410d615d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.248.126.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:06:31.000Z",
      "valid_until": "2026-06-25T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T08:55:37.687Z",
      "x_nadsec_last_seen": "2026-05-24T08:55:37.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-05-24T09:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--93cfdb26-f02c-40fd-b154-915ff2ad44ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.233.65.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:06:31.000Z",
      "valid_until": "2026-06-25T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T08:48:22.279Z",
      "x_nadsec_last_seen": "2026-05-24T08:50:27.503Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-24T09:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55352; asn_org=Microscan Internet Limited",
      "id": "indicator--9b31e4f7-c28e-4d52-8b0d-68eaf32989f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T09:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.251.14.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:06:31.000Z",
      "valid_until": "2026-06-25T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T08:20:15.180Z",
      "x_nadsec_last_seen": "2026-05-24T08:22:20.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55352"
      ],
      "x_nadsec_orgs": [
        "Microscan Internet Limited"
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--16345b5b-c2db-46a3-9e57-3ef4f707058d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.53.249.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T09:59:36.775Z",
      "x_nadsec_last_seen": "2026-05-24T10:01:43.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--f5b75eb3-9715-4001-8e88-475a2c91a754",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T21:11:30.023Z",
      "x_nadsec_last_seen": "2026-05-24T09:58:31.344Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--4d7779c2-68ca-4d70-87ff-9c3c901a6085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T09:58:32.343Z",
      "x_nadsec_last_seen": "2026-05-24T09:58:32.343Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--fc2f2fac-8702-4474-a6ba-c5d76b71a7ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-22T22:47:10.865Z",
      "x_nadsec_last_seen": "2026-05-24T09:58:40.245Z",
      "x_nadsec_ports": [
        "135",
        "81"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--b22ebf27-2f19-42a3-b662-245ecc314593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-22T21:10:14.066Z",
      "x_nadsec_last_seen": "2026-05-24T09:59:22.603Z",
      "x_nadsec_ports": [
        "27017",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "mongod",
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--b803ce56-b274-4d92-a12d-98d90873e197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.178.208.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T10:00:57.700Z",
      "x_nadsec_last_seen": "2026-05-24T10:00:58.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T09:20:55.582Z",
      "x_nadsec_last_seen": "2026-05-24T09:20:55.582Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--0a5d88d7-6184-4d1a-b7ae-4c8db6e6b09b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.6.102.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T09:39:46.504Z",
      "x_nadsec_last_seen": "2026-05-24T09:46:50.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-24T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:05:11.000Z",
      "valid_until": "2026-06-25T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T09:36:04.738Z",
      "x_nadsec_last_seen": "2026-05-24T09:36:04.738Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-24T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c017f1a0-ccee-4d64-9ca1-58f2132734e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:05:11.000Z",
      "valid_until": "2026-06-25T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T10:48:59.964Z",
      "x_nadsec_last_seen": "2026-05-24T10:49:00.313Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=21299; asn_org=Kar-Tel LLC; user(top)=**",
      "id": "indicator--dcc2c3b3-49f7-4404-91a5-8ebd2b0869c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.247.213.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:05:11.000Z",
      "valid_until": "2026-06-25T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T10:23:12.337Z",
      "x_nadsec_last_seen": "2026-05-27T02:04:00.794Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--62669e3a-fce0-450a-b481-83d7c6ded36a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.203.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:05:11.000Z",
      "valid_until": "2026-06-25T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T10:13:02.874Z",
      "x_nadsec_last_seen": "2026-05-24T10:13:02.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-24T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=11221; asn_org=WHRO Public Media",
      "id": "indicator--ca261299-4666-4242-8326-6e11e3c7b13f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.5.141.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:05:11.000Z",
      "valid_until": "2026-06-25T11:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T10:23:08.556Z",
      "x_nadsec_last_seen": "2026-05-24T10:23:12.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11221"
      ],
      "x_nadsec_orgs": [
        "WHRO Public Media"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9658; asn_org=Eastern Telecoms Phils., Inc.",
      "id": "indicator--0f86822c-1932-44a5-a424-4a7efa050eea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.50.235.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T11:16:19.942Z",
      "x_nadsec_last_seen": "2026-05-24T11:18:25.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9658"
      ],
      "x_nadsec_orgs": [
        "Eastern Telecoms Phils., Inc."
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--cf43a14d-95e3-4f29-bd96-2a623da1f91a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.234.129.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T12:04:46.099Z",
      "x_nadsec_last_seen": "2026-05-28T05:25:48.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--0c50f2da-a889-4a5c-a31b-66f6a5fcadf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.79.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T11:22:10.494Z",
      "x_nadsec_last_seen": "2026-05-24T11:22:17.279Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5d396cb6-5cc7-4dd9-812b-092499afa344",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.51.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T11:31:27.135Z",
      "x_nadsec_last_seen": "2026-05-24T11:31:27.135Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--5c3a2e8d-167d-434d-8ee9-da9a61661980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.7.241.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T11:51:47.932Z",
      "x_nadsec_last_seen": "2026-05-29T20:27:04.426Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--439c502f-126d-4d81-b4a8-d32225c25e4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.135.123.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T11:39:18.700Z",
      "x_nadsec_last_seen": "2026-05-24T11:41:25.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3d9c3f92-61b3-4c31-ad21-89949b4beed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.252.107.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T11:56:07.093Z",
      "x_nadsec_last_seen": "2026-05-24T11:58:11.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=5617; asn_org=Orange Polska Spolka Akcyjna",
      "id": "indicator--3cd7fcb4-dd6f-4a39-b13c-743df49589fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.170.137.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T11:52:53.710Z",
      "x_nadsec_last_seen": "2026-05-24T11:53:00.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "5617"
      ],
      "x_nadsec_orgs": [
        "Orange Polska Spolka Akcyjna"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--d12d4e86-1cd9-4a88-b3ba-1da0268f8d5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.160.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T11:46:00.515Z",
      "x_nadsec_last_seen": "2026-05-24T11:46:24.088Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=24163; asn_org=UNION BROADBAND NETWORK",
      "id": "indicator--f3d8f774-95b9-4a7c-814b-3dad888f8fd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.158.197.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T11:51:15.436Z",
      "x_nadsec_last_seen": "2026-05-24T11:57:39.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "24163"
      ],
      "x_nadsec_orgs": [
        "UNION BROADBAND NETWORK"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5adb42fe-6788-4316-84d1-5a04ca56ce89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T10:34:07.256Z",
      "x_nadsec_last_seen": "2026-05-28T03:31:13.523Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b2666e4f-0559-4c00-bcc6-1d171df62946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.249.128.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T11:14:53.765Z",
      "x_nadsec_last_seen": "2026-05-24T11:14:54.119Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=196797; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--8a4edbf8-2b33-4d16-834e-41cc5349788f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.125.95.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T11:32:33.340Z",
      "x_nadsec_last_seen": "2026-05-24T11:32:40.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "196797"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d8794691-efc9-4242-bb28-ba21a06acdb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T11:49:08.540Z",
      "x_nadsec_last_seen": "2026-05-24T11:49:08.540Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d638fdbd-0fc4-4fed-8514-abab4aae4a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T11:49:34.128Z",
      "x_nadsec_last_seen": "2026-05-24T11:49:34.128Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--aa3b1496-f830-41c3-8ad4-585d01e15d61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T11:49:33.932Z",
      "x_nadsec_last_seen": "2026-05-24T11:49:33.932Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-24T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d04e26dc-151d-4051-ad7d-de93c0ab9c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T12:05:10.000Z",
      "valid_until": "2026-06-25T12:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T11:49:08.695Z",
      "x_nadsec_last_seen": "2026-05-24T11:49:08.695Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c73e8381-1b10-4bed-bc94-333646ecb29a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.229.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T12:09:20.271Z",
      "x_nadsec_last_seen": "2026-05-28T05:25:50.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=141679; asn_org=China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch; user(top)=**",
      "id": "indicator--30df0d5c-880f-4152-b440-1bd176101fc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.72.216.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T12:43:13.306Z",
      "x_nadsec_last_seen": "2026-05-24T12:43:13.306Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "141679"
      ],
      "x_nadsec_orgs": [
        "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=27831; asn_org=Colombia Movil",
      "id": "indicator--2e8715d6-7967-4bc4-9a3b-94890025ea20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.204.234.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T12:52:24.687Z",
      "x_nadsec_last_seen": "2026-05-24T12:54:31.106Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27831"
      ],
      "x_nadsec_orgs": [
        "Colombia Movil"
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=RU; asn=47626; asn_org=Timer, LLC; user(top)=u**r; pass(top)=p*******1",
      "id": "indicator--8031065b-d71d-4a69-9408-fc617520e804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.7.219.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T12:53:47.194Z",
      "x_nadsec_last_seen": "2026-05-24T12:53:47.194Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47626"
      ],
      "x_nadsec_orgs": [
        "Timer, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "u**r"
      ],
      "x_nadsec_passwords_attempted": [
        "p*******1"
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--539fb048-e483-4db0-a48d-97ef7eaff5b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.29.23.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T12:11:46.279Z",
      "x_nadsec_last_seen": "2026-05-24T12:11:56.454Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--921ab20e-6360-4e6d-a81e-c8590fcaaf3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.137.15.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T12:29:35.130Z",
      "x_nadsec_last_seen": "2026-05-24T12:31:40.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T12:17:23.717Z",
      "x_nadsec_last_seen": "2026-05-24T12:17:23.717Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-24T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--42cfecac-491a-4c9f-bbed-2c7785c4e537",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.109.238.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:05:10.000Z",
      "valid_until": "2026-06-25T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T12:46:01.687Z",
      "x_nadsec_last_seen": "2026-05-24T12:48:08.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a385fd64-8b2d-4ee9-b62f-8079df2de642",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.168.203.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T13:06:46.660Z",
      "x_nadsec_last_seen": "2026-05-24T13:06:51.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--97592a40-5555-47d5-bcc3-da64b77b7f62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.16.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T13:43:39.777Z",
      "x_nadsec_last_seen": "2026-05-24T13:51:00.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KW; asn=6412; asn_org=Gulfnet International KEMS LLC",
      "id": "indicator--ed4b21d1-1008-4f74-8839-4cbb54ef9fb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.187.111.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T13:44:53.764Z",
      "x_nadsec_last_seen": "2026-05-24T13:47:00.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "6412"
      ],
      "x_nadsec_orgs": [
        "Gulfnet International KEMS LLC"
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--b18579c3-eb08-42db-bae2-55d5bdec871a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.132.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T13:53:43.401Z",
      "x_nadsec_last_seen": "2026-05-24T13:53:44.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--3c73eb3b-2898-4496-a200-d28441276056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.113.140.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T13:34:46.985Z",
      "x_nadsec_last_seen": "2026-05-24T13:39:46.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CA; asn=20161; asn_org=TeraGo Networks Inc.",
      "id": "indicator--c5d6d550-4737-48e3-a334-2ca5e3974058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.11.86.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T13:20:33.473Z",
      "x_nadsec_last_seen": "2026-05-24T13:22:38.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "20161"
      ],
      "x_nadsec_orgs": [
        "TeraGo Networks Inc."
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ebb37a87-b16a-4c64-a690-6c0470d965d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.37.18.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T13:28:00.441Z",
      "x_nadsec_last_seen": "2026-05-24T13:37:03.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-24T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--ef76177f-609f-4388-91c5-76cab2555938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:05:11.000Z",
      "valid_until": "2026-06-25T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T13:50:52.399Z",
      "x_nadsec_last_seen": "2026-05-31T08:33:14.775Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-24T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=58725; asn_org=Nivi Telecom Pvt Ltd",
      "id": "indicator--0b2e6bda-40ea-43ab-a5e6-9fab7906ed6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.12.119.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:05:10.000Z",
      "valid_until": "2026-06-25T15:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-24T14:46:07.898Z",
      "x_nadsec_last_seen": "2026-05-24T17:53:15.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58725"
      ],
      "x_nadsec_orgs": [
        "Nivi Telecom Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-24T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--e9fbc22c-eb9b-4666-9879-2af603115115",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.57.94.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:05:10.000Z",
      "valid_until": "2026-06-25T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T14:25:05.272Z",
      "x_nadsec_last_seen": "2026-05-24T14:32:24.452Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-05-24T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--0e20cb2a-bc27-4209-9f7d-48be77daa409",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.184.125.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:05:10.000Z",
      "valid_until": "2026-06-25T15:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-24T14:55:13.860Z",
      "x_nadsec_last_seen": "2026-05-24T14:55:26.033Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "@******3"
      ]
    },
    {
      "created": "2026-05-24T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=52361; asn_org=Empresa Argentina de Soluciones Satelitales S.A.",
      "id": "indicator--1a554af7-907a-422e-b975-175498553b47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.209.71.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:05:10.000Z",
      "valid_until": "2026-06-25T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T14:24:08.705Z",
      "x_nadsec_last_seen": "2026-05-24T14:26:15.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52361"
      ],
      "x_nadsec_orgs": [
        "Empresa Argentina de Soluciones Satelitales S.A."
      ]
    },
    {
      "created": "2026-05-24T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MN; asn=24320; asn_org=Commercial Center",
      "id": "indicator--c263548b-e1a2-4e43-8b0a-06e30f6327cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.72.240.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:05:10.000Z",
      "valid_until": "2026-06-25T15:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-24T15:00:54.383Z",
      "x_nadsec_last_seen": "2026-05-24T15:44:17.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "24320"
      ],
      "x_nadsec_orgs": [
        "Commercial Center"
      ]
    },
    {
      "created": "2026-05-24T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--ea92a6cf-c511-4645-bcd2-09bbc69784a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.93.191.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T15:05:10.000Z",
      "valid_until": "2026-06-25T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T15:00:45.699Z",
      "x_nadsec_last_seen": "2026-05-30T18:58:07.387Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--2b3ef461-a30e-47b8-bb10-f0752e4eac3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.74.202.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:05:10.000Z",
      "valid_until": "2026-06-25T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T15:26:46.890Z",
      "x_nadsec_last_seen": "2026-05-24T15:28:51.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--78dddcfd-e75f-417f-be19-4588f7bf1e86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.162.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:05:10.000Z",
      "valid_until": "2026-06-25T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T15:48:09.791Z",
      "x_nadsec_last_seen": "2026-05-24T15:50:17.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--f29244ce-d35a-466c-8a7b-78495c01db4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.88.120.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:05:10.000Z",
      "valid_until": "2026-06-25T16:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-24T15:22:00.696Z",
      "x_nadsec_last_seen": "2026-05-24T15:51:14.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--8339f25d-0574-4407-8b7c-54a226a5259c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:05:10.000Z",
      "valid_until": "2026-06-25T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T15:42:06.788Z",
      "x_nadsec_last_seen": "2026-05-24T15:42:06.788Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-24T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:05:10.000Z",
      "valid_until": "2026-06-25T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T15:18:48.715Z",
      "x_nadsec_last_seen": "2026-05-27T03:15:37.615Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--20c7c16b-4303-4693-a7d6-59de81d26cfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.164.40.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T16:37:35.656Z",
      "x_nadsec_last_seen": "2026-05-24T16:39:40.619Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ae946b84-0ee1-4dd7-a4a2-7611efa3fe80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.44.128.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-24T16:15:54.925Z",
      "x_nadsec_last_seen": "2026-05-24T17:31:20.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--34ffab96-a553-4109-a246-59868ca0d3dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.102.39.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T16:06:11.324Z",
      "x_nadsec_last_seen": "2026-05-24T16:06:11.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--186058c2-25f5-4de9-9955-7de35b80e68c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.117.248.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T16:33:57.220Z",
      "x_nadsec_last_seen": "2026-05-24T16:39:13.354Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e392ce38-50f6-4dcc-babf-593f1712a1cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.191.179.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T16:21:01.020Z",
      "x_nadsec_last_seen": "2026-05-24T16:21:29.185Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--8a68c7bc-0806-4ceb-9056-b1b20ff1fe87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.183.36.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T16:45:18.663Z",
      "x_nadsec_last_seen": "2026-05-24T16:47:25.238Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8ca281ef-f275-4407-8bab-4e0502935d6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T16:56:29.996Z",
      "x_nadsec_last_seen": "2026-05-24T16:56:29.996Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d955236b-a124-4e37-ab75-b9ea314670e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.154.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T16:11:03.307Z",
      "x_nadsec_last_seen": "2026-05-24T16:11:03.307Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LV; asn=9002; asn_org=RETN Limited",
      "id": "indicator--e94c1646-b7e9-47bb-9389-f111ec9a22c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.128.33.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T16:15:59.797Z",
      "x_nadsec_last_seen": "2026-05-24T16:16:06.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LV"
      ],
      "x_nadsec_asns": [
        "9002"
      ],
      "x_nadsec_orgs": [
        "RETN Limited"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b30da21a-858d-4819-8bd7-e035a4faf876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.224.229.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T17:01:27.900Z",
      "x_nadsec_last_seen": "2026-05-24T17:01:32.804Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--49165f62-3769-43d6-a1f5-0bf983138f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.70.229.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T16:12:56.212Z",
      "x_nadsec_last_seen": "2026-05-24T16:19:27.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-24T17:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DE; asn=3320; asn_org=Deutsche Telekom AG",
      "id": "indicator--5bb8df17-f464-4485-950d-10a17de8ddcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T17:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.11.188.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T17:05:11.000Z",
      "valid_until": "2026-06-25T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T16:57:45.794Z",
      "x_nadsec_last_seen": "2026-05-24T16:59:52.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "3320"
      ],
      "x_nadsec_orgs": [
        "Deutsche Telekom AG"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--af0e55c1-96a9-41f7-82ea-e9f9a79af0d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.220.157.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T17:41:00.737Z",
      "x_nadsec_last_seen": "2026-05-24T17:43:06.810Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--91e275e7-bae7-4688-bf29-0bb1df517b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.176.151.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T17:08:19.348Z",
      "x_nadsec_last_seen": "2026-05-24T17:10:24.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e64c170-528a-48c5-84ae-2f098316c608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T17:46:06.319Z",
      "x_nadsec_last_seen": "2026-05-24T17:46:06.319Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=GB; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--d60b98a1-464e-497b-8e53-865b911fcfe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.19.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T17:25:36.485Z",
      "x_nadsec_last_seen": "2026-05-27T23:22:52.248Z",
      "x_nadsec_ports": [
        "1883",
        "135"
      ],
      "x_nadsec_services": [
        "mqttd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=270095; asn_org=SALAZAR GUEVARA ELVIS XAVIER CABLE MAGICO",
      "id": "indicator--3e858f50-c996-4127-904f-833c351fef1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.51.136.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-24T17:35:28.144Z",
      "x_nadsec_last_seen": "2026-05-25T03:05:07.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "270095"
      ],
      "x_nadsec_orgs": [
        "SALAZAR GUEVARA ELVIS XAVIER CABLE MAGICO"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.; user(top)=**",
      "id": "indicator--26046a71-8a61-45df-9908-df2694d972f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.91.173.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T18:03:33.596Z",
      "x_nadsec_last_seen": "2026-05-24T18:03:33.596Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d3b15994-e674-49bc-b8ff-234ab5096858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.71.198.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T17:38:12.985Z",
      "x_nadsec_last_seen": "2026-05-24T17:44:43.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--ed0cc409-bbd4-4923-a844-a525cf3e790e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.145.162.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-24T17:13:20.057Z",
      "x_nadsec_last_seen": "2026-05-24T17:52:15.103Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=199731; asn_org=The Educational Center for Internet and New Technologies of the Nakhchivan Autonomous Repub",
      "id": "indicator--05e89785-9259-4965-a22c-d7c701cc8664",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.132.16.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T17:43:51.508Z",
      "x_nadsec_last_seen": "2026-05-24T17:45:58.699Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "199731"
      ],
      "x_nadsec_orgs": [
        "The Educational Center for Internet and New Technologies of the Nakhchivan Autonomous Repub"
      ]
    },
    {
      "created": "2026-05-24T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--bbb6b8ff-7054-4a60-996f-ba1ed736fb07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.175.109.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:05:11.000Z",
      "valid_until": "2026-06-25T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T17:06:45.672Z",
      "x_nadsec_last_seen": "2026-05-24T17:08:52.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e476c3c2-33c9-4876-962a-e9061b4f2afc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.59.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T18:56:07.362Z",
      "x_nadsec_last_seen": "2026-05-24T18:56:27.374Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T19:00:21.490Z",
      "x_nadsec_last_seen": "2026-05-24T19:00:21.490Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4cafa6cf-c4c6-4b1b-8b97-8999b5251847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T18:58:31.354Z",
      "x_nadsec_last_seen": "2026-05-24T18:59:01.097Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1e9a1216-c81e-47c2-a1c1-c7e16b4762b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.235.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T18:07:01.238Z",
      "x_nadsec_last_seen": "2026-05-24T18:07:24.209Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1ceb3fc2-fe99-47c1-aa4f-61cb61647f52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.206.177.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T18:41:00.037Z",
      "x_nadsec_last_seen": "2026-05-24T18:43:06.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--ae6bd4a7-ad7f-456e-9fb3-f8764599e72f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.118.14.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-24T18:33:13.955Z",
      "x_nadsec_last_seen": "2026-05-24T18:46:10.883Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--d80d1110-d993-4963-a677-7d2c2634e10e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.80.200.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T18:59:48.649Z",
      "x_nadsec_last_seen": "2026-05-24T19:01:54.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--dd4e3175-8ae9-4f68-a6a4-368bc9f733d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.47.97.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T18:09:07.000Z",
      "x_nadsec_last_seen": "2026-05-24T18:16:25.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--ce0dcd07-cb30-49a4-8fca-d78e9745ed63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.16.151.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T18:32:45.104Z",
      "x_nadsec_last_seen": "2026-05-24T18:32:45.104Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--7baa5176-c9f3-4a40-89d6-8bbabcf1a4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T18:16:36.761Z",
      "x_nadsec_last_seen": "2026-05-24T18:16:37.248Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--aa494324-c992-4f15-9f85-1e1d558609ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T18:35:16.106Z",
      "x_nadsec_last_seen": "2026-05-24T18:35:16.106Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-24T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--19a82604-8e18-4415-a1b0-0349ad0444a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.44.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:05:11.000Z",
      "valid_until": "2026-06-25T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T18:14:35.267Z",
      "x_nadsec_last_seen": "2026-05-24T18:15:18.683Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-24T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=38511; asn_org=PT Remala Abadi",
      "id": "indicator--d8eaedd1-99a1-40a7-8613-83df12395a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.255.144.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:05:05.000Z",
      "valid_until": "2026-06-25T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T19:48:18.058Z",
      "x_nadsec_last_seen": "2026-05-24T19:50:22.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38511"
      ],
      "x_nadsec_orgs": [
        "PT Remala Abadi"
      ]
    },
    {
      "created": "2026-05-24T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=135817; asn_org=ESTO MEDIA PRIVATE LIMITED; user(top)=**",
      "id": "indicator--296e68f5-843f-4cfd-9eb0-df22771e1d60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.110.164.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:05:05.000Z",
      "valid_until": "2026-06-25T20:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T19:14:54.478Z",
      "x_nadsec_last_seen": "2026-05-27T06:19:00.658Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135817"
      ],
      "x_nadsec_orgs": [
        "ESTO MEDIA PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-24T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c644a39b-600b-4e15-bc16-b070daa4197b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:05:05.000Z",
      "valid_until": "2026-06-25T20:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T19:20:29.017Z",
      "x_nadsec_last_seen": "2026-05-24T19:20:29.257Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-24T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--551b7c9f-e8fa-475a-a368-0c0c9f200354",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.225.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:05:05.000Z",
      "valid_until": "2026-06-25T20:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T19:30:19.372Z",
      "x_nadsec_last_seen": "2026-05-24T19:30:19.372Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-24T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4d5b6bc7-aa3d-440b-8f0f-7363431b45d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:05:05.000Z",
      "valid_until": "2026-06-25T20:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T19:55:00.089Z",
      "x_nadsec_last_seen": "2026-05-31T18:40:50.700Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-24T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--774aa0eb-41c5-442b-8629-275bc1cf47c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T20:05:05.000Z",
      "valid_until": "2026-06-25T20:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T17:40:16.019Z",
      "x_nadsec_last_seen": "2026-05-24T19:33:43.095Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135758; asn_org=Alacriy Net System Service Private Limited",
      "id": "indicator--9b4a9045-bc06-4dd2-a11d-071da99a75a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.134.181.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:05:05.000Z",
      "valid_until": "2026-06-25T21:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T20:47:39.522Z",
      "x_nadsec_last_seen": "2026-05-24T20:49:44.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135758"
      ],
      "x_nadsec_orgs": [
        "Alacriy Net System Service Private Limited"
      ]
    },
    {
      "created": "2026-05-24T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e6274d22-66f3-4193-b58a-9e84f9ea2b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.39.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:05:05.000Z",
      "valid_until": "2026-06-25T21:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T20:40:33.056Z",
      "x_nadsec_last_seen": "2026-05-24T20:40:33.056Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-24T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=197275; asn_org=Link Telecom NN Ltd.",
      "id": "indicator--b25bf906-65df-4079-92ba-25e4b3fe68cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.219.58.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:05:05.000Z",
      "valid_until": "2026-06-25T21:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T20:27:08.903Z",
      "x_nadsec_last_seen": "2026-05-24T20:35:03.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "197275"
      ],
      "x_nadsec_orgs": [
        "Link Telecom NN Ltd."
      ]
    },
    {
      "created": "2026-05-24T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--4bb4819a-7264-426b-bc52-e4dafc98e0fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.186.57.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:05:10.000Z",
      "valid_until": "2026-06-25T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T21:09:14.715Z",
      "x_nadsec_last_seen": "2026-05-24T21:16:12.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-24T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--31cbfd69-a94d-4ff7-9578-1193f3dcde18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.253.208.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:05:10.000Z",
      "valid_until": "2026-06-25T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T21:15:41.467Z",
      "x_nadsec_last_seen": "2026-05-24T21:17:48.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-05-24T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=TR; asn=47331; asn_org=Turk Telekom; user(top)=s****r; pass(top)=2****6",
      "id": "indicator--c33b588a-7cb4-47fc-9e17-333ae2e923fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.171.19.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:05:10.000Z",
      "valid_until": "2026-06-25T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T21:24:02.149Z",
      "x_nadsec_last_seen": "2026-05-24T21:24:02.149Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "47331"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "s****r"
      ],
      "x_nadsec_passwords_attempted": [
        "2****6"
      ]
    },
    {
      "created": "2026-05-24T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=105; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--9428d7fb-5122-446d-84be-3ff207833085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.180.59.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:05:10.000Z",
      "valid_until": "2026-06-25T22:05:09.000Z",
      "x_nadsec_event_count": 1400,
      "x_nadsec_first_seen": "2026-05-24T22:00:22.627Z",
      "x_nadsec_last_seen": "2026-05-24T22:32:03.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--28be2b1a-c473-4456-ad98-54e1e87848b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.171.77.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T23:04:17.193Z",
      "x_nadsec_last_seen": "2026-05-24T23:11:50.682Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b83c4bc2-ac81-4979-bd43-385c942d8e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.226.38.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T22:28:18.443Z",
      "x_nadsec_last_seen": "2026-05-24T22:35:31.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3b292bb3-b638-4e60-8c28-b430cee14698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.174.234.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T22:32:39.796Z",
      "x_nadsec_last_seen": "2026-05-24T22:32:39.796Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--e14f9985-335b-4fe9-b470-cbbe0866a6d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.159.128.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T23:03:00.042Z",
      "x_nadsec_last_seen": "2026-05-24T23:03:07.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7b0a3821-854b-4c80-94b8-b67ce448e22a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-24T22:29:51.824Z",
      "x_nadsec_last_seen": "2026-05-24T22:30:01.984Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--0c61f5a4-e10b-4288-a847-2117febc1d68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.175.199.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-24T22:46:29.295Z",
      "x_nadsec_last_seen": "2026-05-24T22:51:48.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--3adc453d-28e4-45fe-b0f5-816ae359a50b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.91.36.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T22:21:04.780Z",
      "x_nadsec_last_seen": "2026-05-24T22:23:13.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-24T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-24T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T23:05:05.000Z",
      "valid_until": "2026-06-25T23:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-24T22:49:17.294Z",
      "x_nadsec_last_seen": "2026-05-24T22:49:20.344Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-25T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e132bc1b-6557-4d91-b75e-64ca446e4c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.45.167.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:05:05.000Z",
      "valid_until": "2026-06-26T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T23:36:28.878Z",
      "x_nadsec_last_seen": "2026-05-24T23:36:37.340Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-25T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--786d0c5a-94c2-4eff-a989-5435bcfc8a1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.107.233.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:05:05.000Z",
      "valid_until": "2026-06-26T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T23:11:18.731Z",
      "x_nadsec_last_seen": "2026-05-24T23:11:23.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-25T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--be6329e4-9fd4-4bcc-b4d2-8824e4e69d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.200.121.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:05:05.000Z",
      "valid_until": "2026-06-26T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T23:56:49.876Z",
      "x_nadsec_last_seen": "2026-05-24T23:58:57.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-25T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=63969; asn_org=Race Online Limited",
      "id": "indicator--b02cb950-460a-4b73-8505-3f13ef82d5fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.48.79.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:05:05.000Z",
      "valid_until": "2026-06-26T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T23:33:42.365Z",
      "x_nadsec_last_seen": "2026-05-24T23:35:47.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "63969"
      ],
      "x_nadsec_orgs": [
        "Race Online Limited"
      ]
    },
    {
      "created": "2026-05-25T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ebca6ae7-f64d-4c49-90a3-6bd78efe8f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.44.84.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:05:05.000Z",
      "valid_until": "2026-06-26T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T23:18:31.281Z",
      "x_nadsec_last_seen": "2026-05-24T23:20:37.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-25T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:05:05.000Z",
      "valid_until": "2026-06-26T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-24T23:31:59.716Z",
      "x_nadsec_last_seen": "2026-05-24T23:31:59.716Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-25T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--195d2148-9f39-49b3-8af9-625b03efa949",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.52.37.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:05:05.000Z",
      "valid_until": "2026-06-26T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-24T23:45:26.922Z",
      "x_nadsec_last_seen": "2026-05-24T23:47:33.406Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-25T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--55d820a1-a7ee-476f-9b6e-4a97b885eef0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:05:05.000Z",
      "valid_until": "2026-06-26T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T01:22:08.978Z",
      "x_nadsec_last_seen": "2026-05-25T01:22:08.978Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-25T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--83a8f763-aae2-45aa-9ef3-2cc0ee069e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.39.231.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:05:05.000Z",
      "valid_until": "2026-06-26T02:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T01:45:38.290Z",
      "x_nadsec_last_seen": "2026-05-25T01:45:38.340Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-25T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--222d9b2d-acca-4e85-8630-80edeeb1b13d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.255.148.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:05:05.000Z",
      "valid_until": "2026-06-26T02:05:04.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-25T01:03:39.608Z",
      "x_nadsec_last_seen": "2026-05-25T01:22:07.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-25T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b735b81a-8096-41e6-937d-2b5880726c3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:05:05.000Z",
      "valid_until": "2026-06-26T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T01:29:30.158Z",
      "x_nadsec_last_seen": "2026-05-25T01:29:30.158Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-25T02:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cab4d5f3-9225-4e41-8fd7-541991c9d14c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T02:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:05:05.000Z",
      "valid_until": "2026-06-26T02:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T01:29:29.937Z",
      "x_nadsec_last_seen": "2026-05-25T01:29:29.937Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--33db4ef9-f429-4d2b-a117-4fc578998dd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.145.127.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T00:59:33.394Z",
      "x_nadsec_last_seen": "2026-05-25T02:50:55.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--fa9bd514-8a69-4bf9-883f-9586f3900269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.145.140.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T00:59:33.286Z",
      "x_nadsec_last_seen": "2026-05-25T02:50:22.121Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=38482; asn_org=Biznet ISP",
      "id": "indicator--aac46888-d773-429a-bc87-52f90f881024",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.78.187.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T02:44:13.170Z",
      "x_nadsec_last_seen": "2026-05-25T02:50:50.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38482"
      ],
      "x_nadsec_orgs": [
        "Biznet ISP"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2758fb09-eb83-410e-8565-4458dd89f253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.165.75.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T02:51:49.815Z",
      "x_nadsec_last_seen": "2026-05-25T02:51:55.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--13acdaba-7485-40a4-b5ab-397493937ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.152.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T02:30:40.744Z",
      "x_nadsec_last_seen": "2026-05-25T02:30:41.414Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c0d6c10c-87eb-4880-9424-6f439796f71f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.254.102.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T02:52:12.360Z",
      "x_nadsec_last_seen": "2026-05-25T02:54:20.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--a5a315a7-a4e8-4eb9-9f69-9b1ee7a08cf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.221.50.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T03:02:52.427Z",
      "x_nadsec_last_seen": "2026-05-25T03:05:00.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--d01eef29-a8b2-4a62-9e2a-87b46b9d453f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.138.158.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-25T02:42:28.673Z",
      "x_nadsec_last_seen": "2026-05-25T02:47:57.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--34f2c689-c735-4afc-893b-1fd7742fcdc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.119.41.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T02:28:57.483Z",
      "x_nadsec_last_seen": "2026-05-25T02:28:57.483Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--32e88b7d-5f08-4820-8b6a-f82a3d525f34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.113.45.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T02:42:54.788Z",
      "x_nadsec_last_seen": "2026-05-25T02:45:00.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--60d38d3e-c1c0-4e1e-abfd-e9417c598517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '48.214.144.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T02:54:56.676Z",
      "x_nadsec_last_seen": "2026-05-25T02:54:56.676Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--32b01d9e-2862-4b81-9fef-fc9a4d1039be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.235.232.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-22T00:05:12.235Z",
      "x_nadsec_last_seen": "2026-05-25T02:24:03.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-25T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--f6de97dd-db08-4423-834a-9d759943f586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.255.209.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:05:10.000Z",
      "valid_until": "2026-06-26T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T02:47:58.877Z",
      "x_nadsec_last_seen": "2026-05-25T02:50:05.516Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--e2428eab-0542-495a-addd-c3f1cf8c8257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.120.78.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T03:08:14.615Z",
      "x_nadsec_last_seen": "2026-05-25T03:10:19.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=LK; asn=18001; asn_org=Dialog Axiata PLC.",
      "id": "indicator--8c13df84-68bb-4c09-bfd1-b7cfeaf0e8d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.255.35.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T03:56:32.442Z",
      "x_nadsec_last_seen": "2026-05-25T03:57:12.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "18001"
      ],
      "x_nadsec_orgs": [
        "Dialog Axiata PLC."
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--052ce853-9b36-40cc-9941-5e6a5fab20b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.95.189.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T03:38:07.830Z",
      "x_nadsec_last_seen": "2026-05-25T03:45:34.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dee5f18d-7015-43ef-ae7d-a5f39f105268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.228.138.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T03:51:35.904Z",
      "x_nadsec_last_seen": "2026-05-25T03:53:41.035Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--2f2f8a2e-1a78-475f-8282-f78f02493893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.180.63.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T03:09:06.563Z",
      "x_nadsec_last_seen": "2026-05-25T03:11:12.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--eb998234-edeb-4e10-885f-4b2d87ee7665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.200.214.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T03:54:19.751Z",
      "x_nadsec_last_seen": "2026-05-25T03:56:26.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e5168cf9-5429-451e-9d9c-1b13c43e6371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.97.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T03:24:45.253Z",
      "x_nadsec_last_seen": "2026-05-25T03:24:45.995Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--fd9b98db-6c32-4aa5-bccd-ae645eef6995",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.163.87.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T03:13:31.370Z",
      "x_nadsec_last_seen": "2026-05-25T03:15:38.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50022; asn_org=Kristelecom Ltd.",
      "id": "indicator--3240a201-0162-464a-ba4b-d4e1ede7c940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.110.241.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T03:10:46.931Z",
      "x_nadsec_last_seen": "2026-05-25T03:12:54.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50022"
      ],
      "x_nadsec_orgs": [
        "Kristelecom Ltd."
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--591127f8-1805-401f-9fbc-11688fea66c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.138.190.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-25T03:19:09.256Z",
      "x_nadsec_last_seen": "2026-05-25T03:22:59.850Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--072133d1-2370-4451-b993-6d4aa96b119f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T04:03:25.211Z",
      "x_nadsec_last_seen": "2026-05-25T04:03:25.211Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CY; asn=6866; asn_org=Cyprus Telecommunications Authority",
      "id": "indicator--1dcd20c2-edca-4f77-ba79-e3b8a87e66cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.228.126.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:05:12.000Z",
      "valid_until": "2026-06-26T04:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T03:44:49.546Z",
      "x_nadsec_last_seen": "2026-05-25T03:44:49.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "6866"
      ],
      "x_nadsec_orgs": [
        "Cyprus Telecommunications Authority"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--82dfa518-512d-40e2-b33b-49c7a58969b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.53.249.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T05:01:26.854Z",
      "x_nadsec_last_seen": "2026-05-25T05:03:33.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=140061; asn_org=Qinghai Telecom",
      "id": "indicator--21837fbe-0c13-49ba-8858-768df3a7eb68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.167.200.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T04:16:18.441Z",
      "x_nadsec_last_seen": "2026-05-25T04:18:26.762Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "140061"
      ],
      "x_nadsec_orgs": [
        "Qinghai Telecom"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7d42f5ff-ce33-4c55-adea-b1ade40e07f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.183.95.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T04:26:08.149Z",
      "x_nadsec_last_seen": "2026-05-25T04:32:33.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1d232ca8-16da-42ef-a66d-da6f38e7b655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.41.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T04:32:06.673Z",
      "x_nadsec_last_seen": "2026-05-25T04:34:11.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5fc2451a-96e5-4f7f-bb1a-02e7c416e4fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T04:15:14.721Z",
      "x_nadsec_last_seen": "2026-05-25T04:15:14.721Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--9e1fef11-dd1f-41d1-8c11-eae1813c555d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T04:25:20.412Z",
      "x_nadsec_last_seen": "2026-05-25T04:33:34.340Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--00af173a-be02-4727-9f32-7fee614c50af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-25T04:12:54.696Z",
      "x_nadsec_last_seen": "2026-05-25T04:13:30.759Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=201174; asn_org=Tbilisi City Hall",
      "id": "indicator--4077f294-2b00-432c-9d30-ed0acb56b856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.83.37.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-25T04:53:48.385Z",
      "x_nadsec_last_seen": "2026-05-25T10:14:05.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "201174"
      ],
      "x_nadsec_orgs": [
        "Tbilisi City Hall"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--65ddd3bb-5c69-4d32-8dad-d3889ed931c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.226.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T04:15:27.656Z",
      "x_nadsec_last_seen": "2026-05-25T04:17:35.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--13ea094f-d521-47cc-b11e-86ee7ed47634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.89.110.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T04:12:17.473Z",
      "x_nadsec_last_seen": "2026-05-25T04:14:24.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--15448fff-0074-4299-9141-4f07b189b47c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.34.151.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T04:16:11.979Z",
      "x_nadsec_last_seen": "2026-05-25T04:16:50.726Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--1c8c022b-a1aa-4456-a272-614576784f47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.52.236.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T04:16:08.434Z",
      "x_nadsec_last_seen": "2026-05-25T04:16:08.434Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--10154dcb-9b02-422c-817c-bae807da6f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.74.107.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T04:10:26.320Z",
      "x_nadsec_last_seen": "2026-05-25T04:12:31.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-25T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d63a573f-7094-40e2-a56e-168ea6e30f7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.126.115.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:05:10.000Z",
      "valid_until": "2026-06-26T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T04:25:09.932Z",
      "x_nadsec_last_seen": "2026-05-25T04:27:16.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--3dbdd90b-3316-4aae-bc12-4846ab23d24f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.53.37.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T05:17:39.081Z",
      "x_nadsec_last_seen": "2026-05-25T05:19:45.570Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--f5f2ec32-4dcf-44e9-a15c-35d13c78a347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.96.41.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T05:13:53.606Z",
      "x_nadsec_last_seen": "2026-05-25T05:16:01.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SG; asn=45143; asn_org=SINGTEL MOBILE INTERNET SERVICE PROVIDER Singapore",
      "id": "indicator--4cf5a7e4-7db3-4843-bfa8-cdd8a69a53da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.65.57.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T05:51:13.370Z",
      "x_nadsec_last_seen": "2026-05-25T05:51:13.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45143"
      ],
      "x_nadsec_orgs": [
        "SINGTEL MOBILE INTERNET SERVICE PROVIDER Singapore"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SG; asn=45143; asn_org=SINGTEL MOBILE INTERNET SERVICE PROVIDER Singapore",
      "id": "indicator--a6cd1cee-787a-4d06-8e2a-2069a8b20b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.65.69.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T05:49:09.600Z",
      "x_nadsec_last_seen": "2026-05-25T05:51:14.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45143"
      ],
      "x_nadsec_orgs": [
        "SINGTEL MOBILE INTERNET SERVICE PROVIDER Singapore"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--db525e61-c7b6-4121-ad01-23e2ff6385d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.19.230.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T05:37:47.439Z",
      "x_nadsec_last_seen": "2026-05-25T05:39:52.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--30ed341e-8dd7-4abb-af1b-fdce3b5b0636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T05:36:00.569Z",
      "x_nadsec_last_seen": "2026-05-25T05:36:10.957Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--888c83bb-8982-4430-b3a5-3b14f8bbbfba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.96.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T05:18:19.532Z",
      "x_nadsec_last_seen": "2026-05-25T05:18:19.532Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6278b9b2-966c-45ce-8e99-6e34499bb813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.243.175.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T05:18:23.551Z",
      "x_nadsec_last_seen": "2026-05-25T05:18:23.551Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--dedc4173-ff5b-4ea5-b65c-10f24ebc5842",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.254.64.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T05:48:46.226Z",
      "x_nadsec_last_seen": "2026-05-25T05:51:01.864Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=21928; asn_org=T-Mobile USA, Inc.",
      "id": "indicator--2f384e0d-2f04-45ab-a266-bad286d88a27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.58.245.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T05:47:46.588Z",
      "x_nadsec_last_seen": "2026-05-25T05:52:58.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "21928"
      ],
      "x_nadsec_orgs": [
        "T-Mobile USA, Inc."
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--28fb221f-9eab-4245-9ee9-a1f6938d905e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.134.202.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T05:42:07.994Z",
      "x_nadsec_last_seen": "2026-05-25T05:49:43.542Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bdf59664-f1d2-4365-a638-7fa15e288092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.134.206.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T05:47:37.499Z",
      "x_nadsec_last_seen": "2026-05-25T05:49:45.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--25fb015d-797c-4192-9a99-531d9c514e27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.121.13.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T05:22:44.113Z",
      "x_nadsec_last_seen": "2026-05-25T05:24:50.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c97a308b-3f2e-412f-9a2a-ed08540b11ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.60.121.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T05:10:15.822Z",
      "x_nadsec_last_seen": "2026-05-25T05:15:49.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28635; asn_org=AVATO TECNOLOGIA S.A",
      "id": "indicator--a99946ea-18dd-43a3-b06c-a6c8bbb8f5eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.71.157.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T05:43:34.012Z",
      "x_nadsec_last_seen": "2026-05-25T05:45:40.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28635"
      ],
      "x_nadsec_orgs": [
        "AVATO TECNOLOGIA S.A"
      ]
    },
    {
      "created": "2026-05-25T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KG; asn=8449; asn_org=ElCat Ltd.",
      "id": "indicator--85c388fb-0cca-49b1-98d1-fc7f39d33e28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.42.109.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:05:10.000Z",
      "valid_until": "2026-06-26T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T05:50:14.703Z",
      "x_nadsec_last_seen": "2026-05-25T05:50:15.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "8449"
      ],
      "x_nadsec_orgs": [
        "ElCat Ltd."
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--40c5c937-f1eb-4b7a-9df1-690c934f64e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.126.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T06:15:32.609Z",
      "x_nadsec_last_seen": "2026-05-25T06:17:38.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=135607; asn_org=Infinivan Incorporated",
      "id": "indicator--a0e8e009-96a7-4ea4-8af0-907c0b4f536c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '126.209.72.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T06:53:20.573Z",
      "x_nadsec_last_seen": "2026-05-25T06:55:24.994Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135607"
      ],
      "x_nadsec_orgs": [
        "Infinivan Incorporated"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--6fe668de-e1c4-41dc-b931-6b6d15e15ded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.180.24.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T06:14:36.664Z",
      "x_nadsec_last_seen": "2026-05-25T06:21:18.879Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--da38092f-0c08-49bf-aeda-d91cf9d6ee60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.13.96.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T06:56:01.273Z",
      "x_nadsec_last_seen": "2026-05-25T06:58:06.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=46049; asn_org=Universitas Diponegoro",
      "id": "indicator--f5fcd9a4-ae00-47e5-9d68-f4a982b7a7dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.255.3.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T06:17:26.227Z",
      "x_nadsec_last_seen": "2026-05-25T06:19:30.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "46049"
      ],
      "x_nadsec_orgs": [
        "Universitas Diponegoro"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=46049; asn_org=Universitas Diponegoro",
      "id": "indicator--04a8f3f5-c1d5-45b2-a2ca-802b7b7aae35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.255.6.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T06:12:58.981Z",
      "x_nadsec_last_seen": "2026-05-25T06:19:29.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "46049"
      ],
      "x_nadsec_orgs": [
        "Universitas Diponegoro"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f4725a00-f325-414c-9e8c-573807dfb8fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.15.162.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T06:30:10.329Z",
      "x_nadsec_last_seen": "2026-05-25T06:30:10.329Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.; user(top)=**",
      "id": "indicator--b07e2bca-1a9f-40b5-8772-0d80e9138610",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.92.210.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T06:46:52.458Z",
      "x_nadsec_last_seen": "2026-05-25T06:46:52.458Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a5b76747-1b36-4617-bf6a-972dd22ae07a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.207.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T06:38:27.746Z",
      "x_nadsec_last_seen": "2026-05-25T06:38:27.746Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e5f8123a-9118-4541-90a8-64357ce444fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.94.105.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T07:04:10.446Z",
      "x_nadsec_last_seen": "2026-05-25T07:06:14.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC",
      "id": "indicator--c1b6fa27-9e1b-485a-bc2f-4212574443c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '50.151.191.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T06:24:31.853Z",
      "x_nadsec_last_seen": "2026-05-25T06:24:31.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7922"
      ],
      "x_nadsec_orgs": [
        "Comcast Cable Communications, LLC"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--023ed1db-c29b-4d08-b650-af6b0a8d8e25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.8.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T06:47:51.484Z",
      "x_nadsec_last_seen": "2026-05-26T13:58:18.048Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e3698796-0c26-4dc4-bed6-c7ec73e38aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-14T14:31:48.841Z",
      "x_nadsec_last_seen": "2026-05-25T06:35:51.319Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-25T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f722be6d-b2c1-4054-be36-de478b441f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.20.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:05:11.000Z",
      "valid_until": "2026-06-26T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T06:47:38.592Z",
      "x_nadsec_last_seen": "2026-05-25T06:47:50.788Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--ec7f1669-36e9-4058-8f8d-801eb47af124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.55.14.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T07:50:41.577Z",
      "x_nadsec_last_seen": "2026-05-25T07:57:32.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d5678bf1-01bb-4d55-88bf-5a30be8fd911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.43.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T07:35:31.915Z",
      "x_nadsec_last_seen": "2026-05-25T07:42:27.860Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--aa0c689f-cf91-4af5-9dc8-a2ec35fef82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.96.142.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T07:08:39.405Z",
      "x_nadsec_last_seen": "2026-05-25T07:10:44.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=4755; asn_org=TATA Communications formerly VSNL is Leading ISP",
      "id": "indicator--88a85f84-7645-4730-bbcf-027997861c9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.240.212.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T07:38:04.499Z",
      "x_nadsec_last_seen": "2026-05-25T07:41:58.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "4755"
      ],
      "x_nadsec_orgs": [
        "TATA Communications formerly VSNL is Leading ISP"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--86e4f4de-ab98-491d-8f07-47d154936dde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.27.26.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T07:22:01.855Z",
      "x_nadsec_last_seen": "2026-05-25T07:24:05.766Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--25ecded5-54c7-4ab2-b2b9-af82abe1b169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.97.232.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T07:59:07.675Z",
      "x_nadsec_last_seen": "2026-05-25T08:01:13.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--4ce42abb-b33b-4779-8da0-965150851938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.4.112.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-25T08:00:09.633Z",
      "x_nadsec_last_seen": "2026-05-25T08:15:46.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--6bc6546d-5400-4346-9060-860d0f9f00bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.191.253.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-25T07:23:04.805Z",
      "x_nadsec_last_seen": "2026-05-31T05:17:26.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=27323; asn_org=Wowrack.com",
      "id": "indicator--f82ce247-e5a4-4fcd-8ab4-99b9a2d959fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '208.115.109.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T07:05:56.926Z",
      "x_nadsec_last_seen": "2026-05-25T07:05:57.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "27323"
      ],
      "x_nadsec_orgs": [
        "Wowrack.com"
      ]
    },
    {
      "created": "2026-05-25T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=41012; asn_org=The Cloud Networks Limited",
      "id": "indicator--04241a3d-163f-4d3b-831e-c056bd8467e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.119.44.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T08:05:12.000Z",
      "valid_until": "2026-06-26T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T07:12:12.719Z",
      "x_nadsec_last_seen": "2026-05-25T07:14:18.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "41012"
      ],
      "x_nadsec_orgs": [
        "The Cloud Networks Limited"
      ]
    },
    {
      "created": "2026-05-25T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ec397f1c-255c-40a3-a9c5-5de3cb545cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.133.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:05:10.000Z",
      "valid_until": "2026-06-26T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T08:41:47.564Z",
      "x_nadsec_last_seen": "2026-05-25T08:41:47.564Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-25T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--bf32216e-0d68-45ef-999a-c23d1bb4f04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.134.82.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:05:10.000Z",
      "valid_until": "2026-06-26T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T08:38:16.796Z",
      "x_nadsec_last_seen": "2026-05-25T08:45:23.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-05-25T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=39824; asn_org=JSC Alma Telecommunications",
      "id": "indicator--4e9309a9-e9f1-4f82-b450-43d4e248ee25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.103.168.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:05:10.000Z",
      "valid_until": "2026-06-26T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T08:56:49.230Z",
      "x_nadsec_last_seen": "2026-05-25T09:03:34.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "39824"
      ],
      "x_nadsec_orgs": [
        "JSC Alma Telecommunications"
      ]
    },
    {
      "created": "2026-05-25T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--77f6c922-dcec-485a-bbec-3f7721fe9caf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.72.108.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:05:10.000Z",
      "valid_until": "2026-06-26T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T08:34:35.270Z",
      "x_nadsec_last_seen": "2026-05-25T08:41:30.954Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-25T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--628303e4-5582-4995-8d85-c0a01c2fa49e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.100.162.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:05:10.000Z",
      "valid_until": "2026-06-26T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T08:48:34.734Z",
      "x_nadsec_last_seen": "2026-05-25T08:50:40.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-25T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--0e8d669f-be8a-4524-aa99-03b60d0dbd7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T09:05:10.000Z",
      "valid_until": "2026-06-26T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T08:22:41.127Z",
      "x_nadsec_last_seen": "2026-05-30T23:20:24.728Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--1e7258b1-0795-46db-b767-c81e5b039615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.169.252.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T09:55:03.290Z",
      "x_nadsec_last_seen": "2026-05-25T09:55:03.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--1df86651-e304-4841-a963-c41b310bc9b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.51.53.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T09:59:37.164Z",
      "x_nadsec_last_seen": "2026-05-25T10:06:17.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--58190f8f-1f6c-428a-aacd-9c32a24ef51b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.198.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T09:44:50.202Z",
      "x_nadsec_last_seen": "2026-05-25T09:46:55.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--2086e90e-2e66-48f4-9ae7-6e8315ac921b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.173.28.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T09:50:46.580Z",
      "x_nadsec_last_seen": "2026-05-25T09:50:46.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=24; services=pptpd; ports=1723; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.179.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-05-25T10:00:12.804Z",
      "x_nadsec_last_seen": "2026-05-25T10:01:14.233Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "21",
        "1433",
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "ftpd",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=KZ; asn=58172; asn_org=Freedom Data Centers LLP",
      "id": "indicator--b7241e1b-d68d-4955-8f84-8770d8b3cb8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.20.181.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 3150,
      "x_nadsec_first_seen": "2026-05-25T10:00:33.640Z",
      "x_nadsec_last_seen": "2026-05-28T03:42:57.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "58172"
      ],
      "x_nadsec_orgs": [
        "Freedom Data Centers LLP"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--65df4e03-92f9-4e39-a2cb-7807d45497c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.33.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T09:32:25.815Z",
      "x_nadsec_last_seen": "2026-05-25T09:32:25.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--00155eb3-a736-4c9e-92ae-f1d6f9a46a22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.88.228.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T09:14:40.635Z",
      "x_nadsec_last_seen": "2026-05-25T09:16:45.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--d8e2ebbc-28c3-4464-b49f-bbb054edec07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.158.157.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T09:07:42.335Z",
      "x_nadsec_last_seen": "2026-05-25T09:08:08.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a900aceb-7be8-4091-8f90-dc366247d001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T10:01:30.912Z",
      "x_nadsec_last_seen": "2026-05-25T10:01:30.912Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--3763d167-a835-4c7c-8bb0-5486cf4212b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.237.80.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T10:02:09.855Z",
      "x_nadsec_last_seen": "2026-05-25T10:04:14.887Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-25T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CY; asn=6866; asn_org=Cyprus Telecommunications Authority",
      "id": "indicator--4e9cf072-39d7-4b5f-b5c4-ee3746b1079a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.109.163.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:05:11.000Z",
      "valid_until": "2026-06-26T10:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T09:43:11.919Z",
      "x_nadsec_last_seen": "2026-05-25T09:45:19.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "6866"
      ],
      "x_nadsec_orgs": [
        "Cyprus Telecommunications Authority"
      ]
    },
    {
      "created": "2026-05-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--56e3b373-5b41-42e3-b289-477bbbe33ea5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.186.177.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:05:10.000Z",
      "valid_until": "2026-06-26T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T10:56:30.899Z",
      "x_nadsec_last_seen": "2026-05-25T10:58:36.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=LY; asn=37284; asn_org=Aljeel-net",
      "id": "indicator--a3e5a7eb-4406-44be-960a-e945b36d82d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.16.42.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:05:10.000Z",
      "valid_until": "2026-06-26T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T10:23:38.373Z",
      "x_nadsec_last_seen": "2026-05-25T10:25:43.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LY"
      ],
      "x_nadsec_asns": [
        "37284"
      ],
      "x_nadsec_orgs": [
        "Aljeel-net"
      ]
    },
    {
      "created": "2026-05-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=58461; asn_org=CT-HangZhou-IDC",
      "id": "indicator--21a9277b-f6c4-4a73-a707-825d1b5ab9b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.134.217.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:05:10.000Z",
      "valid_until": "2026-06-26T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T10:40:32.193Z",
      "x_nadsec_last_seen": "2026-05-25T10:40:32.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58461"
      ],
      "x_nadsec_orgs": [
        "CT-HangZhou-IDC"
      ]
    },
    {
      "created": "2026-05-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--c1ac1963-15b5-4524-b948-b0c7c018e270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.233.74.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:05:10.000Z",
      "valid_until": "2026-06-26T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T10:49:06.650Z",
      "x_nadsec_last_seen": "2026-05-25T10:51:11.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--439dacf9-3165-4d01-a795-37b7079824d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.130.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:05:10.000Z",
      "valid_until": "2026-06-26T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T10:55:24.824Z",
      "x_nadsec_last_seen": "2026-05-25T10:55:48.959Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; user(top)=**",
      "id": "indicator--da3108b5-1dc1-40f6-9416-9e2613c0deef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.149.239.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:05:10.000Z",
      "valid_until": "2026-06-26T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T10:27:50.811Z",
      "x_nadsec_last_seen": "2026-05-25T10:27:51.670Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=39927; asn_org=E-Light-Telecom Ltd.",
      "id": "indicator--433b7059-b4fc-4bf0-96e5-7c43af56c33a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.181.2.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:05:10.000Z",
      "valid_until": "2026-06-26T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T10:45:04.989Z",
      "x_nadsec_last_seen": "2026-05-25T10:53:46.105Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39927"
      ],
      "x_nadsec_orgs": [
        "E-Light-Telecom Ltd."
      ]
    },
    {
      "created": "2026-05-25T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--9401123c-f2a5-491f-b273-e7643e4b1329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.219.66.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:05:10.000Z",
      "valid_until": "2026-06-26T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T11:30:33.923Z",
      "x_nadsec_last_seen": "2026-05-25T11:32:39.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-25T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f823dc23-a606-429c-865c-d2e671ed691b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.34.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:05:10.000Z",
      "valid_until": "2026-06-26T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T11:25:30.655Z",
      "x_nadsec_last_seen": "2026-05-25T11:27:35.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--6ac35cca-0212-42fd-9add-67cf2fc925ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.53.129.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:05:10.000Z",
      "valid_until": "2026-06-26T12:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T11:33:38.588Z",
      "x_nadsec_last_seen": "2026-05-25T11:35:43.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-25T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4265268a-d1f9-475c-aad1-b5d5c0db8a28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.192.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:05:10.000Z",
      "valid_until": "2026-06-26T12:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T12:02:38.405Z",
      "x_nadsec_last_seen": "2026-05-25T12:02:39.058Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--32208822-79aa-4e95-ac27-4fa86b9b8055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.233.74.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:05:10.000Z",
      "valid_until": "2026-06-26T12:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T12:02:21.792Z",
      "x_nadsec_last_seen": "2026-05-25T12:08:54.297Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-25T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PT; asn=12353; asn_org=Vodafone Portugal - Communicacoes Pessoais S.A.",
      "id": "indicator--e03edadb-3f9a-4960-a700-40dd01c87bf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.62.83.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:05:10.000Z",
      "valid_until": "2026-06-26T12:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T11:15:34.187Z",
      "x_nadsec_last_seen": "2026-05-25T11:23:26.517Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "12353"
      ],
      "x_nadsec_orgs": [
        "Vodafone Portugal - Communicacoes Pessoais S.A."
      ]
    },
    {
      "created": "2026-05-25T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=58461; asn_org=CT-HangZhou-IDC; user(top)=**",
      "id": "indicator--748beb0a-9bee-481e-8ebd-21ffc76dab9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.124.154.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:05:10.000Z",
      "valid_until": "2026-06-26T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T12:18:15.554Z",
      "x_nadsec_last_seen": "2026-05-25T12:18:15.554Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58461"
      ],
      "x_nadsec_orgs": [
        "CT-HangZhou-IDC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=43812; asn_org=Elfimov Sergey Ivanovich PE",
      "id": "indicator--dd1ce91b-6ac5-4ecb-80b2-35dcf87857f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.20.179.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:05:10.000Z",
      "valid_until": "2026-06-26T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T12:23:30.272Z",
      "x_nadsec_last_seen": "2026-05-25T12:25:37.144Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43812"
      ],
      "x_nadsec_orgs": [
        "Elfimov Sergey Ivanovich PE"
      ]
    },
    {
      "created": "2026-05-25T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--89657540-e5fc-4e11-9ce3-adfe3a80f787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.96.139.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T13:05:10.000Z",
      "valid_until": "2026-06-26T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T13:03:49.893Z",
      "x_nadsec_last_seen": "2026-05-25T13:03:49.893Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--a94c6499-25b1-4ec0-aa5f-9a3b4bc68f74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.96.19.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T14:01:21.255Z",
      "x_nadsec_last_seen": "2026-05-25T14:03:29.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--f9430072-5690-4cd4-a04f-0f7b892f66a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.188.123.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T13:52:46.281Z",
      "x_nadsec_last_seen": "2026-05-25T13:54:53.141Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--10e640e5-de14-4049-a678-80131c952cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.44.162.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T13:36:31.198Z",
      "x_nadsec_last_seen": "2026-05-26T14:35:49.858Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--9fbde65e-c8b8-4877-85d5-038d5c480791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.115.180.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-25T13:07:20.462Z",
      "x_nadsec_last_seen": "2026-05-29T10:06:24.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=58096; asn_org=Viter Evgeniy Vasilevich",
      "id": "indicator--5a91cdc5-a6c0-4609-ab40-507298b0de20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.154.75.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T13:57:40.963Z",
      "x_nadsec_last_seen": "2026-05-25T14:08:23.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "58096"
      ],
      "x_nadsec_orgs": [
        "Viter Evgeniy Vasilevich"
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--564be129-336d-4b60-b29e-c02a58cdc0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.177.11.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T13:38:35.197Z",
      "x_nadsec_last_seen": "2026-05-26T14:37:54.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--fcb0f6f3-99ec-4b67-a152-d84f94d15be9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T13:43:14.056Z",
      "x_nadsec_last_seen": "2026-05-25T13:43:14.056Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6bbd2e41-79d3-49d3-a192-9484680b78b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.142.205.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-25T13:44:27.234Z",
      "x_nadsec_last_seen": "2026-05-25T13:47:03.788Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "0**0"
      ]
    },
    {
      "created": "2026-05-25T14:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--a815246e-ead9-4ae0-9a28-d6e8ac8a2e6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T14:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.253.12.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:05:12.000Z",
      "valid_until": "2026-06-26T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T13:08:56.437Z",
      "x_nadsec_last_seen": "2026-05-25T13:15:17.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-25T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--f729bab4-e266-4d50-b554-644544c9c95a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.211.121.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:05:10.000Z",
      "valid_until": "2026-06-26T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T14:28:50.221Z",
      "x_nadsec_last_seen": "2026-05-25T14:30:56.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-25T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--1d701c47-2758-4d80-8351-20b1182ca412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.111.215.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:05:10.000Z",
      "valid_until": "2026-06-26T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T14:58:03.159Z",
      "x_nadsec_last_seen": "2026-05-25T14:58:03.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f5b456fd-7d8a-479d-bf3f-666344cb794f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T15:54:58.279Z",
      "x_nadsec_last_seen": "2026-05-25T15:54:58.684Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--df1c5e2c-0897-4c72-976b-3f357fa4dcce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.182.253.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T15:52:28.940Z",
      "x_nadsec_last_seen": "2026-05-25T15:54:36.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--f570560c-0b3c-40bf-afdc-9e627770dc4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.90.245.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T15:41:13.236Z",
      "x_nadsec_last_seen": "2026-05-25T15:43:19.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--c65d83c7-13b7-440d-8350-dabdf4dfce22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.164.183.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T15:38:56.684Z",
      "x_nadsec_last_seen": "2026-05-25T15:41:01.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--f42df1b1-ab19-4b20-b22a-b76d268b4b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.74.203.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T15:09:19.484Z",
      "x_nadsec_last_seen": "2026-05-25T15:11:26.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8e7d6e11-7741-4960-a79e-2a3a47ffeec1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.140.210.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T15:24:54.462Z",
      "x_nadsec_last_seen": "2026-05-25T15:28:58.796Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--f9f56be3-0648-4c66-bea3-f4a921a1b6ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.192.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T15:56:45.054Z",
      "x_nadsec_last_seen": "2026-05-25T15:56:45.054Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-25T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=18447; asn_org=Ntirety, Inc.",
      "id": "indicator--2c1e00e0-aff9-4884-83d4-d67e26a0910e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.113.228.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:05:09.000Z",
      "valid_until": "2026-06-26T16:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T15:37:11.609Z",
      "x_nadsec_last_seen": "2026-05-25T15:37:11.718Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "18447"
      ],
      "x_nadsec_orgs": [
        "Ntirety, Inc."
      ]
    },
    {
      "created": "2026-05-25T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=55699; asn_org=PT. Cemerlang Multimedia",
      "id": "indicator--38dd82d4-182b-4331-9973-eb34fc022882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.84.146.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:05:10.000Z",
      "valid_until": "2026-06-26T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T16:47:55.721Z",
      "x_nadsec_last_seen": "2026-05-25T16:47:55.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55699"
      ],
      "x_nadsec_orgs": [
        "PT. Cemerlang Multimedia"
      ]
    },
    {
      "created": "2026-05-25T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--76088751-3d57-48a0-b2c2-c311c0e9c1b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.156.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:05:10.000Z",
      "valid_until": "2026-06-26T17:05:08.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-25T16:51:52.167Z",
      "x_nadsec_last_seen": "2026-05-25T16:52:46.594Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--065cd1ad-d83c-44db-81c1-a4f961137517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.227.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:05:10.000Z",
      "valid_until": "2026-06-26T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T16:51:44.259Z",
      "x_nadsec_last_seen": "2026-05-25T16:51:44.259Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--036077e2-a5ca-4e5c-ae01-fd8a548c42d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.174.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:05:10.000Z",
      "valid_until": "2026-06-26T17:05:08.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-05-25T16:05:22.269Z",
      "x_nadsec_last_seen": "2026-05-25T16:06:16.690Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=63473; asn_org=HostHatch, LLC",
      "id": "indicator--e9750fe3-d171-4a7b-a5d0-fd264459f991",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.180.149.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:05:10.000Z",
      "valid_until": "2026-06-26T17:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-25T16:28:05.820Z",
      "x_nadsec_last_seen": "2026-05-28T22:31:03.955Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "63473"
      ],
      "x_nadsec_orgs": [
        "HostHatch, LLC"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--79bcf8db-4605-4c86-b914-d46ac37831c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.250.29.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T17:48:13.478Z",
      "x_nadsec_last_seen": "2026-05-25T17:50:18.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=24538; asn_org=DIGITAL SATELLITE INDONESIA PT.",
      "id": "indicator--43429236-ec89-4b29-a3ed-15d99096755b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.200.51.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T17:19:21.394Z",
      "x_nadsec_last_seen": "2026-05-25T17:22:08.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24538"
      ],
      "x_nadsec_orgs": [
        "DIGITAL SATELLITE INDONESIA PT."
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2554ad19-c3da-4288-b416-ed9c5c33885b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.16.119.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-25T17:17:48.922Z",
      "x_nadsec_last_seen": "2026-05-25T17:53:07.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d61f117b-0641-4b20-82e9-2a2a698e3c02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.113.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T17:53:10.822Z",
      "x_nadsec_last_seen": "2026-05-25T17:53:10.822Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--26ae36c2-b38c-42a8-9aa0-ed8263d71318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.235.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-20T18:57:36.789Z",
      "x_nadsec_last_seen": "2026-05-28T17:54:44.652Z",
      "x_nadsec_ports": [
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=22616; asn_org=ZSCALER, INC.",
      "id": "indicator--6b58eaa3-b8c9-4d13-bc53-284a65b84b46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.225.57.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T17:20:37.489Z",
      "x_nadsec_last_seen": "2026-05-25T17:22:42.732Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22616"
      ],
      "x_nadsec_orgs": [
        "ZSCALER, INC."
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--557b7188-fa5f-41cb-a429-fcc16d92c593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.224.252.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-25T17:33:48.940Z",
      "x_nadsec_last_seen": "2026-05-25T17:47:38.160Z",
      "x_nadsec_ports": [
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--47817b63-90c9-44f0-a9f1-f4d040d03a97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.248.26.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T17:49:22.515Z",
      "x_nadsec_last_seen": "2026-05-25T17:55:57.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--dba8937e-c4fe-45ec-8bca-0e2d96e3920b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.44.72.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T17:09:06.240Z",
      "x_nadsec_last_seen": "2026-05-25T17:16:22.775Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b81bbb83-903f-4a86-a26f-0efd545b0738",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T17:08:37.861Z",
      "x_nadsec_last_seen": "2026-05-25T17:08:37.861Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-25T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--75d86fa0-df97-4eaa-8416-44169366af7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.183.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:05:10.000Z",
      "valid_until": "2026-06-26T18:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T17:32:55.817Z",
      "x_nadsec_last_seen": "2026-05-25T17:33:05.976Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c9232b0e-cb36-43a6-a116-9c7bd6c39c04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.236.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:05:10.000Z",
      "valid_until": "2026-06-26T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T18:07:07.247Z",
      "x_nadsec_last_seen": "2026-05-25T18:07:28.536Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4c6cdbc8-a164-4dcf-a731-377acf8050e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:05:10.000Z",
      "valid_until": "2026-06-26T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T18:46:20.346Z",
      "x_nadsec_last_seen": "2026-05-25T18:46:40.966Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-25T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--0881cf67-6106-4714-988e-cab0d39458b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.79.220.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:05:10.000Z",
      "valid_until": "2026-06-26T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T18:59:00.074Z",
      "x_nadsec_last_seen": "2026-05-25T19:04:57.064Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-25T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--755ff90e-ffda-4469-94eb-dec279f5fbe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.91.182.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:05:10.000Z",
      "valid_until": "2026-06-26T19:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-21T10:29:46.730Z",
      "x_nadsec_last_seen": "2026-05-25T18:25:21.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-25T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=35203; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d88697a6-386c-4b06-bbf2-d3fb30847576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:05:10.000Z",
      "valid_until": "2026-06-26T19:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T18:08:12.046Z",
      "x_nadsec_last_seen": "2026-05-25T18:08:12.049Z",
      "x_nadsec_ports": [
        "42",
        "35203"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--7a971010-dca9-462f-a612-86aefb9bf516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.131.12.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T19:43:32.980Z",
      "x_nadsec_last_seen": "2026-05-25T19:47:00.116Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=9829; asn_org=National Internet Backbone; user(top)=**",
      "id": "indicator--8f9ac43d-380f-4897-b111-cbe1781274d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.247.81.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T19:43:43.497Z",
      "x_nadsec_last_seen": "2026-05-25T19:43:43.497Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--76c53a45-ec26-4768-89dc-d7684bf1a9ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.175.249.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T20:00:35.022Z",
      "x_nadsec_last_seen": "2026-05-25T20:02:39.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=264731; asn_org=Corporacion Digitel C.A.",
      "id": "indicator--a5371959-8091-4b77-80a7-6aa5c8ace4a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.167.179.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T19:36:05.988Z",
      "x_nadsec_last_seen": "2026-05-25T19:44:14.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264731"
      ],
      "x_nadsec_orgs": [
        "Corporacion Digitel C.A."
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=60064; asn_org=Hostpalace Datacenters Ltd",
      "id": "indicator--25c682f3-8439-4a1b-aa62-7ede3554ae37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.142.24.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T19:31:06.639Z",
      "x_nadsec_last_seen": "2026-05-26T05:06:59.841Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "60064"
      ],
      "x_nadsec_orgs": [
        "Hostpalace Datacenters Ltd"
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MA; asn=36925; asn_org=ASMedi",
      "id": "indicator--e0b78bd4-9800-4659-aa8e-f2a8c6403e51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.153.58.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T19:41:14.220Z",
      "x_nadsec_last_seen": "2026-05-25T19:41:14.982Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36925"
      ],
      "x_nadsec_orgs": [
        "ASMedi"
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28637; asn_org=Cia Proc. de Dados do Estado de S Paulo - Prodesp",
      "id": "indicator--865a2aea-5a73-43e5-ae30-6c34f703ca0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.144.1.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T19:32:38.741Z",
      "x_nadsec_last_seen": "2026-05-25T19:39:45.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28637"
      ],
      "x_nadsec_orgs": [
        "Cia Proc. de Dados do Estado de S Paulo - Prodesp"
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3ac5a14d-9380-4ac8-9092-2c6ea7f8cf9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T19:35:30.891Z",
      "x_nadsec_last_seen": "2026-05-25T19:35:30.891Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--690f43a8-e786-4914-bc2a-50f571515240",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.105.163.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T19:39:13.412Z",
      "x_nadsec_last_seen": "2026-05-25T19:39:13.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-25T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--982192ae-d0ca-4883-ba4d-8fb848651bac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:05:10.000Z",
      "valid_until": "2026-06-26T20:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T19:32:32.769Z",
      "x_nadsec_last_seen": "2026-05-25T19:32:32.769Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=149704; asn_org=PT Panglima Kamayo Media",
      "id": "indicator--937068d3-83d1-4f01-bffb-57e2fd10bf47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.175.80.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T21:04:32.409Z",
      "x_nadsec_last_seen": "2026-05-25T21:10:46.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "149704"
      ],
      "x_nadsec_orgs": [
        "PT Panglima Kamayo Media"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134009; asn_org=NETCOM ENTERPRISES PVT LTD",
      "id": "indicator--2d9c1ac1-0a76-4fed-9758-a12d744c360f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.179.38.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T20:27:09.488Z",
      "x_nadsec_last_seen": "2026-05-25T20:29:15.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134009"
      ],
      "x_nadsec_orgs": [
        "NETCOM ENTERPRISES PVT LTD"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17625; asn_org=BlazeNets Network",
      "id": "indicator--473bba35-e583-436f-9607-35f0f64c2560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.54.15.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T20:05:52.696Z",
      "x_nadsec_last_seen": "2026-05-25T20:12:27.033Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17625"
      ],
      "x_nadsec_orgs": [
        "BlazeNets Network"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1f19c6c1-3930-48fe-ae00-818c87ecef3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.239.176.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T20:48:15.069Z",
      "x_nadsec_last_seen": "2026-05-25T20:55:36.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--13f45681-62d8-4b26-9297-2a9179359c0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.230.53.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T20:33:31.306Z",
      "x_nadsec_last_seen": "2026-05-25T20:35:38.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC",
      "id": "indicator--41d15914-e07d-441f-b748-eac16eaeae1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '12.39.250.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T20:27:02.098Z",
      "x_nadsec_last_seen": "2026-05-25T20:33:47.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7018"
      ],
      "x_nadsec_orgs": [
        "AT&T Enterprises, LLC"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--b5dedb54-337a-42ff-ada6-34fa0078647c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '145.82.197.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T20:29:30.470Z",
      "x_nadsec_last_seen": "2026-05-25T20:31:36.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=44149; asn_org=Ubilink LLC",
      "id": "indicator--4b22e9b2-515d-4e59-9373-1942fe165229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.192.244.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T21:02:10.737Z",
      "x_nadsec_last_seen": "2026-05-25T21:02:10.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44149"
      ],
      "x_nadsec_orgs": [
        "Ubilink LLC"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--57bcb545-fe58-487c-9589-80cfb6422a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.49.68.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T20:28:51.524Z",
      "x_nadsec_last_seen": "2026-05-25T20:28:58.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JO; asn=47887; asn_org=Al-hadatheh Lil-itisalat Wa Al-technologia Co.",
      "id": "indicator--8e84396c-3f5f-4ff6-b0a1-f4000bbe5674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.212.85.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-25T20:11:56.654Z",
      "x_nadsec_last_seen": "2026-05-25T20:19:07.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "47887"
      ],
      "x_nadsec_orgs": [
        "Al-hadatheh Lil-itisalat Wa Al-technologia Co."
      ]
    },
    {
      "created": "2026-05-25T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12332; asn_org=Rostelecom",
      "id": "indicator--8678cae4-fbff-41d1-a507-9520774612eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.102.82.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T21:05:10.000Z",
      "valid_until": "2026-06-26T21:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T20:05:09.803Z",
      "x_nadsec_last_seen": "2026-05-25T20:07:17.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12332"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-25T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:05:10.000Z",
      "valid_until": "2026-06-26T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T21:31:13.707Z",
      "x_nadsec_last_seen": "2026-05-25T21:31:13.707Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-25T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet; user(top)=***; pass(top)=1****6",
      "id": "indicator--cb898d42-8274-4ffa-a292-614f38ecb0d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.164.57.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:05:10.000Z",
      "valid_until": "2026-06-26T22:05:09.000Z",
      "x_nadsec_event_count": 676,
      "x_nadsec_first_seen": "2026-05-25T22:02:53.236Z",
      "x_nadsec_last_seen": "2026-05-26T06:23:42.735Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "a***n",
        "***",
        "u**r",
        "A***n"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s",
        "P********!",
        "a***n",
        "1****3",
        "1****1"
      ]
    },
    {
      "created": "2026-05-25T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3751ecb5-3298-4334-8b56-ceff90affe7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:05:10.000Z",
      "valid_until": "2026-06-26T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T21:31:13.701Z",
      "x_nadsec_last_seen": "2026-05-25T21:31:13.701Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-25T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CH; asn=9009; asn_org=M247 Europe SRL; user(top)=r**t",
      "id": "indicator--c6bedf9e-2ed9-440c-bbd3-574f0bebe9de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.203.45.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:05:10.000Z",
      "valid_until": "2026-06-26T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T21:57:05.091Z",
      "x_nadsec_last_seen": "2026-05-25T21:57:05.091Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CY; asn=47883; asn_org=Kibris Mobile Telekomunikasyon Ltd.",
      "id": "indicator--ce53681f-2f48-4a21-a107-338668c396a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.123.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:05:10.000Z",
      "valid_until": "2026-06-26T22:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T21:13:29.489Z",
      "x_nadsec_last_seen": "2026-05-25T21:15:34.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "47883"
      ],
      "x_nadsec_orgs": [
        "Kibris Mobile Telekomunikasyon Ltd."
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--e5d4fb3e-78a2-4abe-80b4-1fd7b42bd618",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.174.80.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T22:08:20.035Z",
      "x_nadsec_last_seen": "2026-05-25T22:10:25.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=56042; asn_org=China Mobile communications corporation",
      "id": "indicator--d27c22fd-6a0f-4a0f-a899-27029d4dfa57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.53.15.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T22:59:33.326Z",
      "x_nadsec_last_seen": "2026-05-25T23:01:38.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56042"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45528; asn_org=Tikona Infinet Ltd.",
      "id": "indicator--46407f86-6546-47a1-a3a0-29b3d1f6018b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.193.0.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T22:31:10.381Z",
      "x_nadsec_last_seen": "2026-05-25T22:33:15.122Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45528"
      ],
      "x_nadsec_orgs": [
        "Tikona Infinet Ltd."
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--f79e0a28-f34c-4639-8847-a896509ffb10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.255.248.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T22:30:46.527Z",
      "x_nadsec_last_seen": "2026-05-25T22:32:51.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet; user(top)=a*******s; pass(top)=p*******!",
      "id": "indicator--5c71cfef-e3da-4a02-91cf-779cc21ea029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.122.56.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 174,
      "x_nadsec_first_seen": "2026-05-25T22:31:42.359Z",
      "x_nadsec_last_seen": "2026-05-26T06:21:53.158Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "***",
        "a***********r",
        "d**a",
        "w*****t"
      ],
      "x_nadsec_passwords_attempted": [
        "1****e",
        "8*****8",
        "p*******!",
        "1*****7",
        "1********0"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ff901c09-7374-452c-80af-e554ae9019dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:30:02.498Z",
      "x_nadsec_last_seen": "2026-05-25T22:30:02.498Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--d7f3ceb6-2e25-4eaf-87cd-b345cb129140",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.59.231.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T22:10:36.304Z",
      "x_nadsec_last_seen": "2026-05-25T22:12:43.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0cde8c2b-a5d3-4e2b-babd-64de02851c7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.120.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T22:17:25.613Z",
      "x_nadsec_last_seen": "2026-05-25T22:19:30.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--bba6572a-1ff2-4cec-9bdd-565226d8ecea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.247.227.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:28:09.142Z",
      "x_nadsec_last_seen": "2026-05-25T22:28:09.142Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--373e0828-e499-4e54-a090-fbc69356e601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.247.231.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:43.484Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:43.484Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DK; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--f99c5635-6835-4cc1-b049-3daa8789a449",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.247.236.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:17.821Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:17.821Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DK"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IT; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--d0045fdc-ba52-45bb-b728-bcb8eebede96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.253.222.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:22.539Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:22.539Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=SE; asn=42708; asn_org=Glesys AB",
      "id": "indicator--df500ee2-c20d-4d38-81d6-7a857ce4f9fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.224.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:44.115Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:44.115Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SE; asn=42708; asn_org=Glesys AB",
      "id": "indicator--b74172d0-f828-445e-9012-7874210c64a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.226.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:18.578Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:18.578Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=SE; asn=42708; asn_org=Glesys AB",
      "id": "indicator--ce7f8471-73b9-44f1-b235-49000d0d1479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.234.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:28:08.283Z",
      "x_nadsec_last_seen": "2026-05-25T22:28:08.283Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SE; asn=42708; asn_org=Glesys AB",
      "id": "indicator--f9d622cd-1e6a-4790-b2cf-140c89c7914c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.242.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:16.912Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:16.912Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=SE; asn=42708; asn_org=Glesys AB",
      "id": "indicator--a1c54fb6-3412-43e5-83e9-74ad89b1ca7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.246.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:42.582Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:42.582Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=SE; asn=42708; asn_org=Glesys AB",
      "id": "indicator--a3ba60ec-9371-42d4-b520-8d88f63217d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.248.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T22:27:32.579Z",
      "x_nadsec_last_seen": "2026-05-25T22:28:19.173Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SE; asn=42708; asn_org=Glesys AB",
      "id": "indicator--a2d6e53a-ef0f-49aa-8fcb-4611a99fc02e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.73.248.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T22:27:21.782Z",
      "x_nadsec_last_seen": "2026-05-25T22:27:21.782Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "42708"
      ],
      "x_nadsec_orgs": [
        "Glesys AB"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--07f93adc-ff4a-405c-995f-6d924bfb4c0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.6.38.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-25T22:33:58.464Z",
      "x_nadsec_last_seen": "2026-05-25T22:34:49.340Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--8c6f19c6-ea0f-4fd4-80d0-3924fe678545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.6.224.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T23:01:56.062Z",
      "x_nadsec_last_seen": "2026-05-25T23:01:56.062Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-25T23:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2000f64e-b9c2-4ce8-b228-57c5bbb69a9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-25T23:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:05:20.000Z",
      "valid_until": "2026-06-26T23:05:18.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-25T23:02:38.626Z",
      "x_nadsec_last_seen": "2026-05-25T23:03:10.734Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--ac93d83d-d316-4c3e-8020-f2ba08831460",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.10.131.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T23:26:33.302Z",
      "x_nadsec_last_seen": "2026-05-25T23:28:37.833Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T23:13:20.850Z",
      "x_nadsec_last_seen": "2026-05-25T23:13:20.850Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--9c3b5cfd-a524-4f69-8e1e-f2637dc07cf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.143.137.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T23:10:08.452Z",
      "x_nadsec_last_seen": "2026-05-25T23:10:10.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--5bbdb0c9-c019-4676-947b-f9076ffb9fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.48.104.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-25T23:08:03.736Z",
      "x_nadsec_last_seen": "2026-05-25T23:08:04.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--8c4f6776-1b92-4d77-9db9-fdcc263b267a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.132.161.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T23:43:49.166Z",
      "x_nadsec_last_seen": "2026-05-25T23:43:56.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8abfc61a-f7e3-4230-a985-7b8a9d78ff4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T23:18:10.915Z",
      "x_nadsec_last_seen": "2026-05-25T23:18:10.915Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131445; asn_org=Advance Wireless Network",
      "id": "indicator--825e3579-42df-4072-8d62-3fc58c58b9d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.230.45.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T23:30:10.471Z",
      "x_nadsec_last_seen": "2026-05-25T23:32:15.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131445"
      ],
      "x_nadsec_orgs": [
        "Advance Wireless Network"
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e0211bbe-a243-490a-a0ee-9adcf9d1017b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.1.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-25T23:49:31.985Z",
      "x_nadsec_last_seen": "2026-05-25T23:49:31.985Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1852ff23-1c69-4be1-bd19-fc0df0dc6769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.117.50.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:05:10.000Z",
      "valid_until": "2026-06-27T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-25T23:06:22.490Z",
      "x_nadsec_last_seen": "2026-05-25T23:08:29.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=141856; asn_org=A S C S C DIGITAL PRIVATE LIMITED",
      "id": "indicator--b8b3312c-7d6c-45a6-8471-803d7244ea04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.168.95.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T00:32:12.857Z",
      "x_nadsec_last_seen": "2026-05-26T00:34:17.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141856"
      ],
      "x_nadsec_orgs": [
        "A S C S C DIGITAL PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=867; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--6f6c9ef8-b7ea-4b19-875d-0e3576e93a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.163.212.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 3150,
      "x_nadsec_first_seen": "2026-05-26T00:53:55.885Z",
      "x_nadsec_last_seen": "2026-05-26T01:28:06.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=38731; asn_org=CHT Compamy Ltd",
      "id": "indicator--75dff00f-72c4-44d7-9887-7228de34b441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.212.198.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T00:36:18.565Z",
      "x_nadsec_last_seen": "2026-05-26T00:36:18.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "38731"
      ],
      "x_nadsec_orgs": [
        "CHT Compamy Ltd"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**; pass(top)=1******X",
      "id": "indicator--a2cfc45f-b105-4663-a7df-630229ee3213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.19.26.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-26T01:04:50.205Z",
      "x_nadsec_last_seen": "2026-05-26T01:05:02.187Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1******X"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=4713; asn_org=NTT DOCOMO BUSINESS,Inc.",
      "id": "indicator--74ebf0f7-5349-407b-ad8b-c199ff6c16ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.142.31.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T00:17:57.250Z",
      "x_nadsec_last_seen": "2026-05-26T00:20:01.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "4713"
      ],
      "x_nadsec_orgs": [
        "NTT DOCOMO BUSINESS,Inc."
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--bd7a4930-8414-43a9-8c57-8da2fd504c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.185.4.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T00:13:15.765Z",
      "x_nadsec_last_seen": "2026-05-26T00:18:26.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--17cbc85f-5b51-4f3d-a680-befa9ab24ca7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.145.169.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T00:44:39.503Z",
      "x_nadsec_last_seen": "2026-05-26T00:46:44.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--b1403e2f-9ebf-4e9a-a8e2-1c3ae994d4a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.188.116.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T00:12:41.895Z",
      "x_nadsec_last_seen": "2026-05-26T00:14:48.555Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--423fb5e9-6cdc-4783-b5cd-b4287a8e74dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.203.201.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T00:07:28.596Z",
      "x_nadsec_last_seen": "2026-05-26T00:07:28.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--ade465b2-4b33-4f96-ba84-7a491a769b8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.83.106.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T00:59:03.332Z",
      "x_nadsec_last_seen": "2026-05-26T00:59:03.332Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ZA; asn=36994; asn_org=Vodacom-VB; user(top)=**",
      "id": "indicator--3f690731-00d5-4a1e-873a-f854d200c5cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.25.40.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T00:35:46.128Z",
      "x_nadsec_last_seen": "2026-05-26T00:35:46.128Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36994"
      ],
      "x_nadsec_orgs": [
        "Vodacom-VB"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--278342e9-7190-4965-bf77-d22575f3e694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.252.242.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:05:05.000Z",
      "valid_until": "2026-06-27T01:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T00:51:02.625Z",
      "x_nadsec_last_seen": "2026-05-26T00:59:35.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--cfdf913e-b319-4348-ad95-5c1366a97746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.195.74.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T01:35:51.956Z",
      "x_nadsec_last_seen": "2026-05-26T01:37:57.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--97c04b59-95bf-4f6c-b38b-55d9f86c7ca8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.49.54.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T01:20:19.363Z",
      "x_nadsec_last_seen": "2026-05-26T01:22:23.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--51b20f52-ba8e-4e46-8ed9-a2a1b8ddf0b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-26T02:03:59.670Z",
      "x_nadsec_last_seen": "2026-05-26T02:04:43.721Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dc1366d4-bee3-4b37-b2d0-fcab7cf99085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.91.107.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T01:40:44.956Z",
      "x_nadsec_last_seen": "2026-05-26T01:40:55.160Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=142002; asn_org=Scloud Pte Ltd",
      "id": "indicator--c2f65c96-0b0f-4dc0-a649-0e6c14b13b9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.206.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T02:05:06.966Z",
      "x_nadsec_last_seen": "2026-05-26T02:05:06.966Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "142002"
      ],
      "x_nadsec_orgs": [
        "Scloud Pte Ltd"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=17439; asn_org=NTT COMMUNICATIONS INDIA NETWORK SERVICES PRIVATE LIMITED; user(top)=**",
      "id": "indicator--ec58d380-8fce-42dd-b437-92e34ccd1015",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.179.236.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T01:35:08.877Z",
      "x_nadsec_last_seen": "2026-05-26T01:35:08.877Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17439"
      ],
      "x_nadsec_orgs": [
        "NTT COMMUNICATIONS INDIA NETWORK SERVICES PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--db61dc84-2d6f-43de-ade5-876bd2df5f81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.250.45.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T01:08:29.785Z",
      "x_nadsec_last_seen": "2026-05-26T01:10:34.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--2ef4abf6-8e38-4ae3-aefd-f146d0e47025",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.87.215.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T01:25:06.236Z",
      "x_nadsec_last_seen": "2026-05-26T01:31:39.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--9c1f4075-d964-4037-97ff-d9471361663d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.88.214.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T01:06:54.069Z",
      "x_nadsec_last_seen": "2026-05-26T01:06:58.391Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--cabdd4d5-7291-445c-ab97-e822e2462f2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.52.89.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T01:16:21.823Z",
      "x_nadsec_last_seen": "2026-05-26T01:17:08.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-05-26T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9137d497-3579-4199-944f-2ab188e346a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:05:10.000Z",
      "valid_until": "2026-06-27T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-09T16:46:41.863Z",
      "x_nadsec_last_seen": "2026-05-26T01:35:58.944Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--f287d190-eefb-448a-b51c-c066d62b55fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.240.243.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-26T02:21:23.542Z",
      "x_nadsec_last_seen": "2026-05-26T07:10:07.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58479; asn_org=Trisakti University",
      "id": "indicator--9f7900b5-3c4d-4a45-9771-a0a2419fb567",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.49.68.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-26T02:37:25.806Z",
      "x_nadsec_last_seen": "2026-05-26T05:22:37.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58479"
      ],
      "x_nadsec_orgs": [
        "Trisakti University"
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BD; asn=136514; asn_org=Rashedur Rahman ta Onesky Communications Limited.",
      "id": "indicator--278e258c-926e-4654-8e2b-0012d03ec97b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.253.37.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T02:20:38.264Z",
      "x_nadsec_last_seen": "2026-05-26T02:22:40.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "136514"
      ],
      "x_nadsec_orgs": [
        "Rashedur Rahman ta Onesky Communications Limited."
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--7e293ef4-3adc-47b8-8d29-40eec80f434a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.235.120.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-26T02:21:14.783Z",
      "x_nadsec_last_seen": "2026-05-26T03:49:28.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--fea988fb-0aff-41bb-ab6e-d3d9e1c446f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.233.28.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T02:38:55.062Z",
      "x_nadsec_last_seen": "2026-05-26T02:40:59.811Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=3255; asn_org=LLC Eksintech",
      "id": "indicator--e508db47-d8b3-4e37-a501-f142de0ba551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.44.211.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T02:38:41.679Z",
      "x_nadsec_last_seen": "2026-05-26T02:40:47.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3255"
      ],
      "x_nadsec_orgs": [
        "LLC Eksintech"
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--e16ecd30-a6e4-4fca-b680-10817ffe433a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.57.239.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T02:35:22.765Z",
      "x_nadsec_last_seen": "2026-05-26T02:37:29.191Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--8d8fddfe-e876-490e-82b2-bcbf0785c89e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.1.218.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T02:59:13.664Z",
      "x_nadsec_last_seen": "2026-05-26T03:01:21.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--4653caf7-fa8e-4238-beb1-8a8aa51261d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.18.106.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-26T03:02:31.301Z",
      "x_nadsec_last_seen": "2026-05-26T17:10:04.518Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1b35d543-15aa-4c7c-a0ef-814db9f16b59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.77.29.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T02:28:24.675Z",
      "x_nadsec_last_seen": "2026-05-26T02:35:12.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-26T03:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--058292be-ddf4-436f-bcbe-170235099f4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T03:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.159.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:05:23.000Z",
      "valid_until": "2026-06-27T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T02:18:16.615Z",
      "x_nadsec_last_seen": "2026-05-26T02:18:16.615Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--0a494757-effd-4064-a918-c18743c4cf2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.163.98.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T03:37:05.809Z",
      "x_nadsec_last_seen": "2026-05-26T03:43:36.547Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--56484017-8c41-4c54-8d07-0fabaac06daa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.54.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T03:15:35.364Z",
      "x_nadsec_last_seen": "2026-05-30T20:05:56.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4c698809-89e9-4d24-b6b0-9a06b9b564d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.161.58.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-26T04:01:15.548Z",
      "x_nadsec_last_seen": "2026-05-26T04:47:14.407Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--e02c5220-5d9d-4f07-9264-b862b5c05861",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.128.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T03:38:19.896Z",
      "x_nadsec_last_seen": "2026-05-26T03:38:20.291Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--4a459658-68bd-40c0-b448-6b8b618a204b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.217.32.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-26T03:24:32.187Z",
      "x_nadsec_last_seen": "2026-05-26T03:28:02.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--19d20a68-5199-4274-b802-0c0be3729418",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.153.160.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-26T03:18:23.929Z",
      "x_nadsec_last_seen": "2026-05-26T07:27:03.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f0a2b573-95a3-4823-b7cc-0718d01533e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T03:16:24.850Z",
      "x_nadsec_last_seen": "2026-05-26T03:16:25.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6c04c38f-308a-42fd-9d41-5df8b6d5c305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.77.222.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T03:52:20.615Z",
      "x_nadsec_last_seen": "2026-05-26T03:52:20.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--2c4d2b3a-7f4e-4710-aa5e-d5835274f5e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.241.147.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-26T03:52:50.936Z",
      "x_nadsec_last_seen": "2026-05-26T03:53:31.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--dec52ba8-de5c-4f3a-a9bb-46bb893a8351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.222.95.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T03:22:19.874Z",
      "x_nadsec_last_seen": "2026-05-26T03:24:24.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-26T04:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IL; asn=12400; asn_org=Partner Communications Ltd.",
      "id": "indicator--3806248f-fa9c-454a-95d2-157063319caf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T04:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.159.142.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:05:05.000Z",
      "valid_until": "2026-06-27T04:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T03:30:57.852Z",
      "x_nadsec_last_seen": "2026-05-26T03:36:48.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=132559; asn_org=Gatik Business Solutions",
      "id": "indicator--7fc844c6-61c2-414c-97dd-8d2029eb9229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.180.45.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T05:02:29.529Z",
      "x_nadsec_last_seen": "2026-05-26T05:04:34.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132559"
      ],
      "x_nadsec_orgs": [
        "Gatik Business Solutions"
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a08c5aeb-6dfc-4d20-aefb-d06acc91ff9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.163.187.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T04:44:32.866Z",
      "x_nadsec_last_seen": "2026-05-26T04:51:01.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2aa5574a-99f8-4617-9811-096e71d37fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.216.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-26T04:31:02.610Z",
      "x_nadsec_last_seen": "2026-05-26T04:31:34.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=20207; asn_org=Gigared S.A.",
      "id": "indicator--1019b30b-e95c-43ca-9512-21a6846d952b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.57.232.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T04:51:44.795Z",
      "x_nadsec_last_seen": "2026-05-26T04:59:24.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "20207"
      ],
      "x_nadsec_orgs": [
        "Gigared S.A."
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--58690ba9-be0f-4733-a836-e42dbb166bbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.53.108.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-26T04:23:51.265Z",
      "x_nadsec_last_seen": "2026-05-26T05:02:22.062Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c0bfebfd-dd87-4ab9-9f35-d517a09dc465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T04:08:00.628Z",
      "x_nadsec_last_seen": "2026-05-26T04:08:10.790Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=13440; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--f28bd64f-4d6e-489f-98f8-e80531adcf7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.57.3.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T05:04:56.469Z",
      "x_nadsec_last_seen": "2026-05-26T05:07:01.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13440"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--47f14128-36cf-4d53-bac7-0efcd079d834",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.220.54.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T04:33:48.962Z",
      "x_nadsec_last_seen": "2026-05-26T04:36:00.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--85412b57-4222-49e0-9cce-33ed9b8075d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.223.128.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T04:42:53.943Z",
      "x_nadsec_last_seen": "2026-05-26T04:45:00.650Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-26T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b86ed45c-3c34-4b25-aaa7-b36487656de8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.208.85.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:05:10.000Z",
      "valid_until": "2026-06-27T05:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T04:35:42.435Z",
      "x_nadsec_last_seen": "2026-05-26T04:37:47.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--51e94c2c-f29a-495b-9f49-b58b900a9b9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.118.159.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T05:48:27.874Z",
      "x_nadsec_last_seen": "2026-05-26T05:48:27.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--8828168a-0153-4595-8d25-32b3fb439d0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.25.185.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T05:14:24.055Z",
      "x_nadsec_last_seen": "2026-05-26T05:20:51.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VE; asn=11562; asn_org=Net Uno, C.A.; user(top)=**",
      "id": "indicator--431024e3-9f33-46b4-af0e-414e6153f416",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.6.12.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T05:50:01.195Z",
      "x_nadsec_last_seen": "2026-05-26T05:50:01.195Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--939d1314-34f5-4f21-bca7-55c51089b93b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T05:39:42.722Z",
      "x_nadsec_last_seen": "2026-05-26T05:39:53.050Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=17465; asn_org=Cable ISP in India",
      "id": "indicator--57d29e60-2a87-4c3b-aa53-632379a4f467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.88.251.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T05:41:17.613Z",
      "x_nadsec_last_seen": "2026-05-26T05:41:17.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17465"
      ],
      "x_nadsec_orgs": [
        "Cable ISP in India"
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--a1c185a4-9b9f-410f-95a6-6bdc9b1aecbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.248.248.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T05:17:15.638Z",
      "x_nadsec_last_seen": "2026-05-26T05:21:25.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T05:07:12.392Z",
      "x_nadsec_last_seen": "2026-05-26T05:07:12.392Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c3d68b75-4b68-4ad8-8de5-54454a2a168a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.136.117.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T05:16:50.473Z",
      "x_nadsec_last_seen": "2026-05-26T05:18:57.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=25082; asn_org=Viner Telecom LLC",
      "id": "indicator--0072c4c6-b5a2-4508-9ea7-c2f49a0ce8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.203.140.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:05:11.000Z",
      "valid_until": "2026-06-27T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T05:11:43.837Z",
      "x_nadsec_last_seen": "2026-05-26T05:13:49.930Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "25082"
      ],
      "x_nadsec_orgs": [
        "Viner Telecom LLC"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a6fa2b22-aafc-4d56-8271-d01f8a55f55b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.24.126.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T07:00:37.282Z",
      "x_nadsec_last_seen": "2026-05-26T07:02:42.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--809b7faa-337d-4e8e-a83b-3cfacb0115d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T06:43:25.277Z",
      "x_nadsec_last_seen": "2026-05-26T06:43:25.277Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2b11effe-e251-4f68-a594-220f653d4961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.160.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T06:56:31.924Z",
      "x_nadsec_last_seen": "2026-05-26T07:01:04.747Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--69ecbf83-f14c-4955-b396-2769d2792624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T06:09:44.759Z",
      "x_nadsec_last_seen": "2026-05-26T06:09:44.759Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--e0a1b33c-eae5-4c68-8837-7d1fbe835011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T06:10:33.095Z",
      "x_nadsec_last_seen": "2026-05-26T06:10:33.095Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--bc4d0564-4315-4721-b263-7be5fa6904db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.140.251.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T06:19:16.696Z",
      "x_nadsec_last_seen": "2026-05-26T06:19:16.696Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--02bad0e6-826a-48da-bf96-dab59fe2db77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.177.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T06:19:19.886Z",
      "x_nadsec_last_seen": "2026-05-26T06:19:52.955Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8345; asn_org=JSC ER-Telecom Holding",
      "id": "indicator--2822d9ae-c1ba-4a77-84c6-f0ea2899eb7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.185.63.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T06:41:12.722Z",
      "x_nadsec_last_seen": "2026-05-26T06:43:19.770Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8345"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ]
    },
    {
      "created": "2026-05-26T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi",
      "id": "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:05:06.000Z",
      "valid_until": "2026-06-27T07:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T06:30:12.111Z",
      "x_nadsec_last_seen": "2026-05-26T06:30:12.790Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "211736"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9d9fef45-3cab-44b1-bd23-927a7a74f1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.136.75.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T07:08:40.460Z",
      "x_nadsec_last_seen": "2026-05-26T07:15:09.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--a48c6984-30bf-41c1-ab1a-5c206c494747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.27.220.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T07:25:10.155Z",
      "x_nadsec_last_seen": "2026-05-26T07:27:14.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=10139; asn_org=Smart Broadband, Inc.",
      "id": "indicator--6f625b72-ea2c-4b6e-a678-1d7e20eac838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.176.23.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T07:36:09.599Z",
      "x_nadsec_last_seen": "2026-05-26T07:38:14.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "10139"
      ],
      "x_nadsec_orgs": [
        "Smart Broadband, Inc."
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1698bae8-1a3e-4515-a33b-0d088efacc5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.47.94.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T07:07:05.896Z",
      "x_nadsec_last_seen": "2026-05-26T07:07:12.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bef708f8-fc3f-40e4-a303-eb060bc1986f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.157.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T07:31:11.189Z",
      "x_nadsec_last_seen": "2026-05-26T07:31:11.189Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--513a4b25-9faa-4c60-8501-764df5580dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.129.148.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T07:48:20.039Z",
      "x_nadsec_last_seen": "2026-05-26T07:50:24.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--917ffdda-f02a-4231-870f-cece02c98050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.228.22.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T08:04:42.940Z",
      "x_nadsec_last_seen": "2026-05-26T08:11:48.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--214c327c-ebf7-48e1-9460-6fecbfd6606c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.249.228.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T08:04:27.648Z",
      "x_nadsec_last_seen": "2026-05-26T08:11:13.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=131269; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--2b4bbf59-12a0-4551-b218-2cf33d266b14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.205.97.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T07:53:28.839Z",
      "x_nadsec_last_seen": "2026-05-26T07:55:34.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131269"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-26T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a82e98b4-06c7-477c-8fe1-fa540bcf1cb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.109.40.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:05:10.000Z",
      "valid_until": "2026-06-27T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T08:00:57.615Z",
      "x_nadsec_last_seen": "2026-05-26T08:05:34.573Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--4b7ea520-9cb9-4036-9738-3b1574c21490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.0.255.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:00:40.616Z",
      "x_nadsec_last_seen": "2026-05-26T09:02:45.637Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--53ab3be4-83db-4352-be9b-450ffd52b244",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.190.195.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T08:22:58.282Z",
      "x_nadsec_last_seen": "2026-05-26T08:29:42.980Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--e56f3e30-73c2-4a1a-9407-cb8597cf5a39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.51.69.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T08:24:11.563Z",
      "x_nadsec_last_seen": "2026-05-26T08:26:16.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--6b486f5d-8423-40db-b22f-5044e91498c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.133.193.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-22T08:59:13.849Z",
      "x_nadsec_last_seen": "2026-05-26T09:02:10.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--2bd0aca3-89dc-4db4-a92d-acfc735d5849",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.72.52.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-26T08:57:41.813Z",
      "x_nadsec_last_seen": "2026-05-26T09:08:00.379Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**1"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d30cb2df-b656-405b-9002-e6f796a8bb02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.96.58.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T08:34:55.691Z",
      "x_nadsec_last_seen": "2026-05-26T08:41:57.112Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--409b7e88-af8c-4075-8179-62492ba1b5b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.228.82.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T08:51:07.065Z",
      "x_nadsec_last_seen": "2026-05-26T08:59:43.047Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0b53df44-c7d9-4c71-8966-4ea0b513c40a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.53.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T08:59:24.283Z",
      "x_nadsec_last_seen": "2026-05-26T08:59:24.855Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2d2a464d-ab91-413f-b5e5-15dbc08a3314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T08:10:15.477Z",
      "x_nadsec_last_seen": "2026-05-26T08:10:15.477Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=42548; asn_org=Rostelecom",
      "id": "indicator--bb1e7f2c-ffed-4639-801f-3d7098b49c4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.172.189.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:05:11.000Z",
      "valid_until": "2026-06-27T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T08:10:30.803Z",
      "x_nadsec_last_seen": "2026-05-26T08:10:37.387Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42548"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=37069; asn_org=MOBINIL",
      "id": "indicator--97231a8c-1bf0-4138-8352-c87225a1eb56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.14.21.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:16:58.838Z",
      "x_nadsec_last_seen": "2026-05-26T09:17:05.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "37069"
      ],
      "x_nadsec_orgs": [
        "MOBINIL"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4cc28b83-054c-43bb-8425-a39929272be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.23.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:52:05.821Z",
      "x_nadsec_last_seen": "2026-05-26T09:54:12.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=53118; asn_org=NETLINE TELECOM; user(top)=**",
      "id": "indicator--3e35c285-e0ab-4a98-875b-7e82cb297bd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.12.98.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T09:11:04.689Z",
      "x_nadsec_last_seen": "2026-05-26T09:11:04.689Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53118"
      ],
      "x_nadsec_orgs": [
        "NETLINE TELECOM"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--5cc299d2-d9e4-4ce0-af20-d5856c91ab7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:27:11.886Z",
      "x_nadsec_last_seen": "2026-05-27T17:06:21.568Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--f8b444d4-b913-4a66-8e22-ffa7edf0e4b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.0.144.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T09:31:48.622Z",
      "x_nadsec_last_seen": "2026-05-26T09:38:55.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--9d346f77-f266-4796-b96c-9edf431b555c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.153.146.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:34:38.651Z",
      "x_nadsec_last_seen": "2026-05-26T09:36:45.112Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--a8951c50-8414-4e6e-a7ed-8754d96195d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.6.148.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T10:00:30.770Z",
      "x_nadsec_last_seen": "2026-05-26T10:02:37.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--121668fb-fe31-414a-b36a-b6e639c6ac62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.150.58.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:30:13.960Z",
      "x_nadsec_last_seen": "2026-05-26T09:32:20.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--6ff07a62-0a51-4ebd-9556-7992365a72aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.114.187.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T09:28:14.701Z",
      "x_nadsec_last_seen": "2026-05-26T09:35:09.216Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--62ee34e9-5005-42d8-906a-a6873a553207",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.206.193.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T09:27:51.170Z",
      "x_nadsec_last_seen": "2026-05-26T09:32:14.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=OM; asn=50010; asn_org=Omani Qatari Telecommunication Company SAOC",
      "id": "indicator--e193974f-d90c-4657-a506-030dc5760caf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.21.140.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T09:48:07.340Z",
      "x_nadsec_last_seen": "2026-05-26T09:53:14.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "50010"
      ],
      "x_nadsec_orgs": [
        "Omani Qatari Telecommunication Company SAOC"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c01605da-2d42-4a51-b1dc-2502fd7a5ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '57.151.97.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T09:31:49.038Z",
      "x_nadsec_last_seen": "2026-05-26T09:31:49.038Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--42dcd791-024b-4dcd-a590-41e60c9709cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.216.98.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T09:35:09.357Z",
      "x_nadsec_last_seen": "2026-05-26T09:35:09.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--d3679707-cc4a-4545-8887-a3ae367a4adc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.34.149.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T09:54:45.143Z",
      "x_nadsec_last_seen": "2026-05-26T10:01:44.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=5607; asn_org=Sky UK Limited",
      "id": "indicator--6afd6d03-a464-40bb-b9b3-6bcaa5084595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.119.15.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:47:23.130Z",
      "x_nadsec_last_seen": "2026-05-26T09:49:29.071Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "5607"
      ],
      "x_nadsec_orgs": [
        "Sky UK Limited"
      ]
    },
    {
      "created": "2026-05-26T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--84472559-e922-4592-b5fd-59ed99ff1647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.233.74.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:05:11.000Z",
      "valid_until": "2026-06-27T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T09:11:07.107Z",
      "x_nadsec_last_seen": "2026-05-26T09:13:13.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fa08a2a2-89d3-4c56-a2cd-ece575ecbc07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.185.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T10:38:20.494Z",
      "x_nadsec_last_seen": "2026-05-26T10:44:54.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cacb33a4-73ed-4a49-987d-7b76742ab582",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.180.115.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T10:24:08.811Z",
      "x_nadsec_last_seen": "2026-05-26T10:24:08.811Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--a295233e-d608-4779-8b75-8c36ba7b6259",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.183.45.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-26T10:08:37.930Z",
      "x_nadsec_last_seen": "2026-05-26T10:43:36.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--451b5bd4-4d83-4093-87a2-fe1b22a3991e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.128.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T10:11:00.131Z",
      "x_nadsec_last_seen": "2026-05-26T10:11:30.131Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=17222; asn_org=MUNDIVOX DO BRASIL LTDA",
      "id": "indicator--53fab06f-196a-478c-a23a-9bb9275df93f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.92.80.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T10:28:44.782Z",
      "x_nadsec_last_seen": "2026-05-26T10:36:05.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "17222"
      ],
      "x_nadsec_orgs": [
        "MUNDIVOX DO BRASIL LTDA"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DE; asn=24940; asn_org=Hetzner Online GmbH",
      "id": "indicator--b9fbf61f-0cac-406d-aba1-de0649241bda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.245.208.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T10:31:19.829Z",
      "x_nadsec_last_seen": "2026-05-26T10:31:19.829Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "24940"
      ],
      "x_nadsec_orgs": [
        "Hetzner Online GmbH"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b2e61067-bf24-47ef-a48f-cbca8fe5f361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T10:26:43.069Z",
      "x_nadsec_last_seen": "2026-05-26T10:26:53.399Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--08362e3d-168f-435b-806c-07a1847b3c4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.238.110.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T10:54:43.243Z",
      "x_nadsec_last_seen": "2026-05-26T10:54:43.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-26T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--5954971e-2ce3-408b-8b10-7d39b40c68ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.88.8.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:05:10.000Z",
      "valid_until": "2026-06-27T11:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T10:26:46.234Z",
      "x_nadsec_last_seen": "2026-05-26T10:26:46.234Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--f14d17d4-ce54-4fcc-9b43-55a52c48a84f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.112.104.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T11:08:10.784Z",
      "x_nadsec_last_seen": "2026-05-26T11:15:48.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=264294; asn_org=Ora Servicos de Telecomunicacoes Ltda",
      "id": "indicator--e06ff331-9945-4a0a-8c84-e7a84eb2380f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.107.24.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T11:56:27.744Z",
      "x_nadsec_last_seen": "2026-05-26T11:58:34.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264294"
      ],
      "x_nadsec_orgs": [
        "Ora Servicos de Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--c87cf65b-1c52-4230-b20d-d06a97d65a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.183.9.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T11:32:25.115Z",
      "x_nadsec_last_seen": "2026-05-26T11:34:30.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=265691; asn_org=WI-NET TELECOM S.A.C.; user(top)=**",
      "id": "indicator--f68032f5-cf86-4778-869f-3c13bf1e5b40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.25.42.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T11:35:23.138Z",
      "x_nadsec_last_seen": "2026-05-26T11:35:23.138Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "265691"
      ],
      "x_nadsec_orgs": [
        "WI-NET TELECOM S.A.C."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e762ec6f-f19e-43e6-a41e-7e82c69d630e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.236.55.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T11:43:30.766Z",
      "x_nadsec_last_seen": "2026-05-26T11:43:30.766Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--76fca4ce-079a-4a61-ab39-76c7d58a7807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.179.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T11:58:18.282Z",
      "x_nadsec_last_seen": "2026-05-26T11:58:35.061Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--74d4d780-60e9-4989-9ef2-2a11f5895e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.89.192.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T11:20:30.242Z",
      "x_nadsec_last_seen": "2026-05-26T11:20:30.297Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b397e9f-aba2-4724-b04c-53e4806012ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T11:33:48.863Z",
      "x_nadsec_last_seen": "2026-05-26T11:33:48.863Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-26T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47156; asn_org=Malnet LTD.",
      "id": "indicator--d7a99a7a-fb60-4a4b-b995-db3fd4d701ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.188.204.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:05:10.000Z",
      "valid_until": "2026-06-27T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T11:34:55.306Z",
      "x_nadsec_last_seen": "2026-05-26T11:37:01.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47156"
      ],
      "x_nadsec_orgs": [
        "Malnet LTD."
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=23; services=smbd; ports=445; cc=IN; asn=17465; asn_org=Cable ISP in India",
      "id": "indicator--d2979dd0-547e-4df8-ab17-998316eb3aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.92.87.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-05-26T12:10:46.834Z",
      "x_nadsec_last_seen": "2026-05-26T12:12:57.534Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17465"
      ],
      "x_nadsec_orgs": [
        "Cable ISP in India"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8b9da76b-9f7d-4dbb-b6b2-333075f3b9f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.250.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T12:06:47.389Z",
      "x_nadsec_last_seen": "2026-05-26T12:07:12.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--78a39a2d-903d-4db7-b557-aa56d2e3d254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.250.158.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T12:32:13.120Z",
      "x_nadsec_last_seen": "2026-05-26T12:39:30.561Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=131445; asn_org=Advance Wireless Network",
      "id": "indicator--2ff7d92b-c65d-457e-b21e-c89299c021fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.232.132.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T12:55:41.752Z",
      "x_nadsec_last_seen": "2026-05-26T12:57:47.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131445"
      ],
      "x_nadsec_orgs": [
        "Advance Wireless Network"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ea66e7cc-67fc-459f-8806-52c604ac3c89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.17.214.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T12:10:39.234Z",
      "x_nadsec_last_seen": "2026-05-26T12:12:45.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PY; asn=27895; asn_org=Nucleo S.A.",
      "id": "indicator--17b3a142-1417-4a84-a01f-34000490557b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.3.255.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-26T13:03:18.071Z",
      "x_nadsec_last_seen": "2026-05-27T13:27:30.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "27895"
      ],
      "x_nadsec_orgs": [
        "Nucleo S.A."
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=40021; asn_org=Contabo Inc.",
      "id": "indicator--36fc2d70-6630-48f6-8214-46e5ed78bee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.216.66.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T12:09:06.443Z",
      "x_nadsec_last_seen": "2026-05-26T12:09:06.443Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "40021"
      ],
      "x_nadsec_orgs": [
        "Contabo Inc."
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=20115; asn_org=Charter Communications LLC",
      "id": "indicator--0ecd6554-6950-4fae-903d-aa6248913da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.177.29.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T12:43:08.866Z",
      "x_nadsec_last_seen": "2026-05-26T12:45:14.590Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "20115"
      ],
      "x_nadsec_orgs": [
        "Charter Communications LLC"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a529638d-dc27-4dbd-9ffa-a75c80fdf0a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.74.19.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T12:09:12.778Z",
      "x_nadsec_last_seen": "2026-05-26T12:09:36.648Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=13118; asn_org=Rostelecom",
      "id": "indicator--6e1ed457-a89a-4a4b-bcdb-9b24b98665da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.113.197.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T12:44:06.182Z",
      "x_nadsec_last_seen": "2026-05-26T12:46:12.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "13118"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=212238; asn_org=Datacamp Limited; user(top)=**; pass(top)=**",
      "id": "indicator--22a8d227-98b8-430c-8ef9-f94ea76680e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T12:09:06.691Z",
      "x_nadsec_last_seen": "2026-05-26T12:09:07.890Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "**"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e35636b7-708c-4f50-af5d-354143e48149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.252.244.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T12:31:29.151Z",
      "x_nadsec_last_seen": "2026-05-26T12:33:35.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=29190; asn_org=MTS PJSC",
      "id": "indicator--35a4de61-95fe-4ced-8551-f48e3b0c5ed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.229.237.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T13:03:20.299Z",
      "x_nadsec_last_seen": "2026-05-26T13:05:27.291Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29190"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-05-26T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=41704; asn_org=JSC Ufanet",
      "id": "indicator--5309392f-8124-4c20-9eed-0fb5b604bf2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.105.114.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:05:10.000Z",
      "valid_until": "2026-06-27T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T12:58:44.996Z",
      "x_nadsec_last_seen": "2026-05-26T13:00:51.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41704"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--8974c6fa-b6ed-4edd-8290-aa77dd7d510e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.88.111.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T13:41:35.934Z",
      "x_nadsec_last_seen": "2026-05-26T13:43:43.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--df904429-84cc-4bb6-b6c0-12eea39ed639",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.43.78.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T13:43:15.683Z",
      "x_nadsec_last_seen": "2026-05-26T13:45:20.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--ad1e9d04-f4c3-4847-a781-7327fc2fb000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.107.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-26T13:43:55.263Z",
      "x_nadsec_last_seen": "2026-05-26T13:58:01.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3026db3e-2418-4582-a725-21b44e52df89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.187.132.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T13:06:17.804Z",
      "x_nadsec_last_seen": "2026-05-26T13:08:23.762Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=20207; asn_org=Gigared S.A.",
      "id": "indicator--b9bcf047-f68b-47ad-a2a9-37ce3905f746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.7.60.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T13:46:55.905Z",
      "x_nadsec_last_seen": "2026-05-26T13:49:03.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "20207"
      ],
      "x_nadsec_orgs": [
        "Gigared S.A."
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--fa862367-d037-4d69-a1ab-a336e6492253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T13:51:41.735Z",
      "x_nadsec_last_seen": "2026-05-26T13:51:41.735Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce6ce735-435b-4cb0-b9e2-13bf2f306a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T13:51:42.219Z",
      "x_nadsec_last_seen": "2026-05-26T13:51:42.219Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MA; asn=36925; asn_org=ASMedi",
      "id": "indicator--23b956c6-57c9-4854-8306-cc0b1ee1ea49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.115.79.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T13:44:12.938Z",
      "x_nadsec_last_seen": "2026-05-26T13:46:20.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36925"
      ],
      "x_nadsec_orgs": [
        "ASMedi"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--010f7ab2-100c-4b12-a49c-b2f0ccacbca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.211.103.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-26T13:55:25.500Z",
      "x_nadsec_last_seen": "2026-05-26T13:58:14.495Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.216.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T14:01:32.004Z",
      "x_nadsec_last_seen": "2026-05-28T16:50:27.186Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--28dbf1cc-0ae4-412c-b61e-918f9a658c1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.220.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T13:21:12.098Z",
      "x_nadsec_last_seen": "2026-05-26T13:21:15.525Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T14:06:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--0558e726-79e3-43b2-8173-fd50152aaef3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T14:06:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:06:28.000Z",
      "valid_until": "2026-06-27T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T13:14:28.946Z",
      "x_nadsec_last_seen": "2026-05-26T13:14:37.141Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=135967; asn_org=Bach Kim Network solutions Join stock company; user(top)=**",
      "id": "indicator--56634424-cd22-4931-821e-da0de5f0db65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.121.90.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T14:28:15.730Z",
      "x_nadsec_last_seen": "2026-05-26T14:28:15.730Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135967"
      ],
      "x_nadsec_orgs": [
        "Bach Kim Network solutions Join stock company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--89d2a7da-db1d-4231-b2cd-a56ebcb97a26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.145.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T14:56:48.359Z",
      "x_nadsec_last_seen": "2026-05-26T14:57:17.368Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262702; asn_org=Granadanet Servicos de Informatica SC. Ltda.",
      "id": "indicator--ddf08ac7-e370-4115-8dad-49b9277b081d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.103.87.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T14:12:46.485Z",
      "x_nadsec_last_seen": "2026-05-26T14:14:53.363Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262702"
      ],
      "x_nadsec_orgs": [
        "Granadanet Servicos de Informatica SC. Ltda."
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ede42e8f-b32f-4047-853c-945512a8bd0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.218.61.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T14:43:18.440Z",
      "x_nadsec_last_seen": "2026-05-26T14:45:24.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--a2ac2aae-cc6c-4418-8cb1-5922990502bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.35.64.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T14:54:51.095Z",
      "x_nadsec_last_seen": "2026-05-26T14:56:57.878Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CA; asn=35911; asn_org=Telebec",
      "id": "indicator--5e364cbc-2ed4-46b6-ac43-3e2c87952507",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.212.110.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T14:53:35.871Z",
      "x_nadsec_last_seen": "2026-05-26T14:55:40.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "35911"
      ],
      "x_nadsec_orgs": [
        "Telebec"
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--64ca0923-6fb7-4ff6-85f2-3ffab8f2617f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.68.28.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T14:06:04.342Z",
      "x_nadsec_last_seen": "2026-05-26T14:08:09.590Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-26T15:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=197394; asn_org=CJSC Telecommunications 21",
      "id": "indicator--4007b76c-590a-4777-9c3b-d9012b55e451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T15:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.245.35.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:05:11.000Z",
      "valid_until": "2026-06-27T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T14:38:20.195Z",
      "x_nadsec_last_seen": "2026-05-26T14:38:20.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "197394"
      ],
      "x_nadsec_orgs": [
        "CJSC Telecommunications 21"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=133774; asn_org=Fuzhou; user(top)=**; pass(top)=***",
      "id": "indicator--b517ff16-6dbe-4efc-bd19-49863d174f62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.204.173.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T15:16:49.074Z",
      "x_nadsec_last_seen": "2026-05-26T21:13:04.284Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "133774"
      ],
      "x_nadsec_orgs": [
        "Fuzhou"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--f294e1e3-4a72-433d-8ef8-c915f1fd2f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.69.50.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T15:51:34.030Z",
      "x_nadsec_last_seen": "2026-05-26T15:53:40.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--39f7e346-6b8e-4bb3-bc91-270fbdafb605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.136.57.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T15:56:51.341Z",
      "x_nadsec_last_seen": "2026-05-26T16:03:33.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ca5d21fd-b34d-4d55-87b2-d177f1c2ef45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.235.120.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T15:40:28.216Z",
      "x_nadsec_last_seen": "2026-05-26T20:39:23.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T15:39:43.918Z",
      "x_nadsec_last_seen": "2026-05-26T15:39:43.918Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--fd704152-96ba-47d5-87bd-7237ef3a10d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.79.120.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T15:40:55.168Z",
      "x_nadsec_last_seen": "2026-05-26T15:43:00.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CV; asn=37517; asn_org=CVTS1",
      "id": "indicator--95677964-6c5f-4fbe-9985-a6bbb7ad35ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.74.130.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T15:57:56.478Z",
      "x_nadsec_last_seen": "2026-05-26T15:57:57.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CV"
      ],
      "x_nadsec_asns": [
        "37517"
      ],
      "x_nadsec_orgs": [
        "CVTS1"
      ]
    },
    {
      "created": "2026-05-26T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--48badde7-7e31-4d0c-b047-f2516fd432bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.162.209.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:05:10.000Z",
      "valid_until": "2026-06-27T16:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-13T07:51:30.550Z",
      "x_nadsec_last_seen": "2026-05-26T15:44:17.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-05-26T17:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--d5d1eb3e-1a71-4155-8541-dab2c1ca8350",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.232.99.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:05:15.000Z",
      "valid_until": "2026-06-27T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T16:16:06.702Z",
      "x_nadsec_last_seen": "2026-05-26T16:18:12.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-26T17:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--732df7ec-9186-452f-8796-ff3adc7d5ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.29.214.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:05:15.000Z",
      "valid_until": "2026-06-27T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T16:13:29.810Z",
      "x_nadsec_last_seen": "2026-05-26T16:13:29.810Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-26T17:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--b2794170-19b3-411f-baa4-e076381d757d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.120.107.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:05:15.000Z",
      "valid_until": "2026-06-27T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T17:04:51.349Z",
      "x_nadsec_last_seen": "2026-05-26T17:06:59.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-05-26T17:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--d5fdbe0d-c6f2-46cc-b513-9c9e23025f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '39.153.167.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:05:15.000Z",
      "valid_until": "2026-06-27T17:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T16:16:16.115Z",
      "x_nadsec_last_seen": "2026-05-26T16:16:53.799Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T17:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--6015e7fa-2702-4189-bbed-0b61dace5de1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T17:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.225.3.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:05:15.000Z",
      "valid_until": "2026-06-27T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T16:17:27.675Z",
      "x_nadsec_last_seen": "2026-05-26T16:19:34.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--3261540a-f8ed-420e-8750-d3cc669ccb8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.117.7.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T17:56:18.339Z",
      "x_nadsec_last_seen": "2026-05-26T17:58:26.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--ab164e4c-0160-4159-b2c6-eb06fff43ba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.230.208.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T17:06:08.989Z",
      "x_nadsec_last_seen": "2026-05-26T17:11:13.988Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--410b2ad4-d029-4e87-8d4f-614cc4cf8f02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.138.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T17:55:37.540Z",
      "x_nadsec_last_seen": "2026-05-26T17:56:06.974Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28233; asn_org=I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP",
      "id": "indicator--4ded4870-b890-4d6a-9e67-e29540e2fdbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.194.47.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T17:22:01.635Z",
      "x_nadsec_last_seen": "2026-05-26T17:27:05.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28233"
      ],
      "x_nadsec_orgs": [
        "I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d728544f-64d8-4216-9b70-8007aa233bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.188.193.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-26T17:11:14.227Z",
      "x_nadsec_last_seen": "2026-05-26T19:06:43.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=52468; asn_org=UFINET PANAMA S.A.",
      "id": "indicator--e09c2cce-f8e8-4eb1-ae15-9b75600a4a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.60.61.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T17:37:22.772Z",
      "x_nadsec_last_seen": "2026-05-26T17:39:28.668Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "52468"
      ],
      "x_nadsec_orgs": [
        "UFINET PANAMA S.A."
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0678ef6e-110e-4b95-b2ad-319f3012c2dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T17:34:14.791Z",
      "x_nadsec_last_seen": "2026-05-26T17:34:14.791Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a3965bef-e5c6-4203-b86b-1e5a58e4dcc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.217.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T17:57:25.786Z",
      "x_nadsec_last_seen": "2026-05-26T17:57:25.786Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7c1aed59-cb99-44d8-b4db-eb52b7ea79ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.221.58.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T17:31:02.640Z",
      "x_nadsec_last_seen": "2026-05-26T17:31:03.355Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e28225b2-baa4-481f-a59e-3c594ab7f92b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T17:32:04.797Z",
      "x_nadsec_last_seen": "2026-05-30T16:45:22.569Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=43991; asn_org=Voronezh Telecom LLC",
      "id": "indicator--6623e55f-a666-4c21-83d7-4889cd7438fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.252.70.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-17T22:53:08.553Z",
      "x_nadsec_last_seen": "2026-05-26T17:10:31.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43991"
      ],
      "x_nadsec_orgs": [
        "Voronezh Telecom LLC"
      ]
    },
    {
      "created": "2026-05-26T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9b987496-72ea-473e-a2d9-6d64b6c386c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.126.144.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:05:10.000Z",
      "valid_until": "2026-06-27T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T17:39:05.906Z",
      "x_nadsec_last_seen": "2026-05-26T17:47:29.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--1b97194c-6f8f-45d0-9a49-577d28d8857e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.81.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T18:37:33.117Z",
      "x_nadsec_last_seen": "2026-05-26T18:45:05.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=24534; asn_org=PT. Transhybrid Communication",
      "id": "indicator--87c18fc3-668c-44fd-bd74-79445ac2a88e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.149.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T18:14:42.080Z",
      "x_nadsec_last_seen": "2026-05-26T18:16:46.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24534"
      ],
      "x_nadsec_orgs": [
        "PT. Transhybrid Communication"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a288c3ff-488d-486a-8d5c-70eceaff4a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.139.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-26T18:07:59.300Z",
      "x_nadsec_last_seen": "2026-05-26T18:08:22.648Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--8d014bd1-95f3-46f3-a9ea-807eb7a5b164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.133.215.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T18:44:50.592Z",
      "x_nadsec_last_seen": "2026-05-26T18:51:49.443Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--bd5bd2c5-6958-4ace-a128-8da52ce4eb06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.130.125.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T18:30:54.780Z",
      "x_nadsec_last_seen": "2026-05-26T18:30:54.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3b9a892f-3739-407b-8912-f0b9aa9508cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T18:30:09.197Z",
      "x_nadsec_last_seen": "2026-05-26T18:30:19.929Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269876; asn_org=SUMINISTROS PCWESTERN, CA WestNet",
      "id": "indicator--1411dc02-5772-4300-b42e-2565dc345d0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.168.174.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T18:48:03.784Z",
      "x_nadsec_last_seen": "2026-05-26T18:50:09.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269876"
      ],
      "x_nadsec_orgs": [
        "SUMINISTROS PCWESTERN, CA WestNet"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4bddc23e-9ac1-4655-bbaa-73b4c9a6ed1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.249.245.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T18:52:22.268Z",
      "x_nadsec_last_seen": "2026-05-26T18:52:41.150Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--4f9d539e-3404-43fc-91a6-3331d7db6e1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.195.215.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T18:58:38.885Z",
      "x_nadsec_last_seen": "2026-05-26T19:00:44.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-05-26T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--7ed60638-b67c-4ca9-8819-0cf5f40cbcea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:05:10.000Z",
      "valid_until": "2026-06-27T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T18:38:37.696Z",
      "x_nadsec_last_seen": "2026-05-26T18:38:37.696Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6e7afc83-ab2b-4325-a292-8216142ef390",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.131.72.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T20:01:46.924Z",
      "x_nadsec_last_seen": "2026-05-26T20:01:46.924Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--f28dc1d7-c31a-41fa-a660-e9de95dd864a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.65.121.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T19:32:52.556Z",
      "x_nadsec_last_seen": "2026-05-26T19:32:52.556Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--19bec093-c11d-478a-af04-e306082a4fdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.32.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T19:39:18.627Z",
      "x_nadsec_last_seen": "2026-05-26T19:41:23.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6dbbdaae-b36a-4f01-89ab-917bc0a65d7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.130.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T19:29:15.583Z",
      "x_nadsec_last_seen": "2026-05-26T19:29:15.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1f1c97c3-c711-420b-be44-d27c5acd1528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.81.239.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T19:47:44.289Z",
      "x_nadsec_last_seen": "2026-05-26T19:49:48.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--cf4e9024-b451-4706-85c1-8122d99cf2a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.237.203.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T19:58:50.123Z",
      "x_nadsec_last_seen": "2026-05-26T19:58:50.123Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--3ec1c69d-b2e6-4f6e-9038-43fd7e374e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.237.213.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T19:57:04.429Z",
      "x_nadsec_last_seen": "2026-05-26T19:57:04.429Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-26T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--60c1ea6c-7007-4a6d-bba8-46aa3ff523c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.243.113.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:05:11.000Z",
      "valid_until": "2026-06-27T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T19:20:11.680Z",
      "x_nadsec_last_seen": "2026-05-26T19:22:16.250Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--08c22af2-2999-4331-81e6-23235b6aab82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.36.146.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T20:31:34.278Z",
      "x_nadsec_last_seen": "2026-05-26T20:33:39.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=53184; asn_org=VERO S.A",
      "id": "indicator--87fe0c2a-c410-4262-8f26-0c0a40824bed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.129.26.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T20:07:51.481Z",
      "x_nadsec_last_seen": "2026-05-26T20:15:13.274Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53184"
      ],
      "x_nadsec_orgs": [
        "VERO S.A"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda; user(top)=**",
      "id": "indicator--8b4a70ae-2ced-40cd-a91a-59bee9f817ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.185.193.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T20:05:31.418Z",
      "x_nadsec_last_seen": "2026-05-26T20:05:31.418Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5c99785f-beef-410b-b06b-f492eff7e9fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T20:59:26.308Z",
      "x_nadsec_last_seen": "2026-05-26T20:59:26.308Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--de65042d-9186-41cd-b23b-1a71da81d440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T20:59:04.999Z",
      "x_nadsec_last_seen": "2026-05-26T20:59:04.999Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8f6fcfcd-25ef-439a-84e1-bca2c92ecd2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T20:59:04.598Z",
      "x_nadsec_last_seen": "2026-05-26T20:59:04.598Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--47e2a0e1-1286-42ed-a2d6-6f346ef20c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T20:59:36.684Z",
      "x_nadsec_last_seen": "2026-05-26T20:59:36.684Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CA; asn=16276; asn_org=OVH SAS",
      "id": "indicator--52b7e7e4-f84f-4f21-b1da-682fea800e3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.50.138.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T20:36:59.589Z",
      "x_nadsec_last_seen": "2026-05-26T20:39:06.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a5dd2709-52ee-4aa4-bc77-9e457dccb28e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T20:40:29.920Z",
      "x_nadsec_last_seen": "2026-05-26T20:40:30.239Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4e55f5d1-38c6-4410-aacc-f2711e0ac840",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.33.56.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:05:10.000Z",
      "valid_until": "2026-06-27T21:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-26T20:11:39.907Z",
      "x_nadsec_last_seen": "2026-05-27T01:50:51.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-26T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52630; asn_org=MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO",
      "id": "indicator--63a04514-16b7-48f8-b322-a3302b2d10ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.233.6.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:05:10.000Z",
      "valid_until": "2026-06-27T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T21:39:19.645Z",
      "x_nadsec_last_seen": "2026-05-26T21:39:33.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52630"
      ],
      "x_nadsec_orgs": [
        "MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO"
      ]
    },
    {
      "created": "2026-05-26T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--ed0bfdc5-5849-4527-befe-fb0df3d56975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.10.3.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:05:10.000Z",
      "valid_until": "2026-06-27T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T21:35:40.027Z",
      "x_nadsec_last_seen": "2026-05-26T21:42:57.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-05-26T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--b5871b91-1bf5-40c2-97f3-c59019ab4f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.189.148.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:05:10.000Z",
      "valid_until": "2026-06-27T22:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T21:12:04.375Z",
      "x_nadsec_last_seen": "2026-05-26T21:19:40.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "17072"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-05-26T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--81eb3ed1-8e7c-4a53-9947-d916be43fba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.205.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:05:10.000Z",
      "valid_until": "2026-06-27T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T21:18:08.236Z",
      "x_nadsec_last_seen": "2026-05-26T21:18:08.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-26T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--b8126300-f384-49da-9ade-0f3475aeab7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.35.240.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:05:10.000Z",
      "valid_until": "2026-06-27T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T21:08:21.930Z",
      "x_nadsec_last_seen": "2026-05-26T21:10:29.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-26T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7c9841ca-6626-43e3-a59f-e50a085f5f8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:05:10.000Z",
      "valid_until": "2026-06-27T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T21:37:29.477Z",
      "x_nadsec_last_seen": "2026-05-26T21:37:29.477Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-26T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1120a2e3-3e3a-44bb-881b-9533f929438e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.22.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T22:05:10.000Z",
      "valid_until": "2026-06-27T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T21:49:04.603Z",
      "x_nadsec_last_seen": "2026-05-26T21:49:04.603Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--707d6393-450b-4a7b-8cf1-f03f0d015258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.193.243.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-21T10:30:21.462Z",
      "x_nadsec_last_seen": "2026-05-26T22:22:46.501Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--131b6074-fac1-40e7-b938-7647fccb2fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.203.204.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T23:00:19.387Z",
      "x_nadsec_last_seen": "2026-05-26T23:00:29.561Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ccb7c101-3b06-4a57-bfaa-1179bbeef28a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.105.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T22:43:31.137Z",
      "x_nadsec_last_seen": "2026-05-26T22:43:31.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--4c17b6d0-7842-4798-8bdd-2f08442f86de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.0.228.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T22:50:42.834Z",
      "x_nadsec_last_seen": "2026-05-26T22:52:49.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--adefce6d-e9fb-433e-9840-d9702f3c56f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.169.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-26T22:42:20.734Z",
      "x_nadsec_last_seen": "2026-05-26T22:43:23.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--71445c6c-730f-414c-875f-20e5e4cd3044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.200.27.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T22:07:14.235Z",
      "x_nadsec_last_seen": "2026-05-26T22:07:14.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--efe138cc-0c64-4af7-8fbd-d9fdebeb1561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.177.19.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T22:29:19.620Z",
      "x_nadsec_last_seen": "2026-05-26T22:31:25.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--6da56c0c-3156-4b62-9f18-a5c066f74f67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.153.177.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T22:58:56.619Z",
      "x_nadsec_last_seen": "2026-05-26T23:01:03.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--c8ab22b4-2190-46fc-9ac9-555d5e9893b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.125.85.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-26T22:26:42.209Z",
      "x_nadsec_last_seen": "2026-05-26T22:35:29.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e596809e-cffb-423a-8ccc-84b8a8674f88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T23:00:59.177Z",
      "x_nadsec_last_seen": "2026-05-26T23:00:59.501Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T22:33:51.833Z",
      "x_nadsec_last_seen": "2026-05-26T22:33:51.833Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fea7e2e9-e5ca-4963-8576-40ece88d8394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.22.25.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-26T22:47:48.685Z",
      "x_nadsec_last_seen": "2026-05-26T22:47:48.768Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-26T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--2c535bd7-e9f1-438e-b515-4b69a40b0399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-26T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T23:05:13.000Z",
      "valid_until": "2026-06-27T23:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T22:08:12.887Z",
      "x_nadsec_last_seen": "2026-05-26T22:08:12.887Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d1f896b9-7420-4f49-9734-3dac84cee3c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.145.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T23:43:30.632Z",
      "x_nadsec_last_seen": "2026-05-26T23:43:30.632Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--294f63d7-1e01-4487-936e-39e667cbdf78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.170.88.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T23:23:31.013Z",
      "x_nadsec_last_seen": "2026-05-26T23:25:35.673Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--eb22821b-3c61-4380-ac88-60144b32fed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.121.61.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T00:00:46.055Z",
      "x_nadsec_last_seen": "2026-05-27T00:02:53.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--e1ed780c-7051-46eb-ab05-398ed9585e78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.220.127.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T23:33:42.298Z",
      "x_nadsec_last_seen": "2026-05-26T23:35:48.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3d9adf8d-3aff-4abb-87b8-52ec007c60ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.194.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-05-27T00:01:02.577Z",
      "x_nadsec_last_seen": "2026-05-27T00:02:05.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d136f6fd-3087-4c35-9cf5-98ef3a5c2f47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-26T23:24:58.224Z",
      "x_nadsec_last_seen": "2026-05-26T23:24:58.224Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c16eef40-437a-47f6-90fe-380264d8b5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.23.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T00:02:13.446Z",
      "x_nadsec_last_seen": "2026-05-27T00:02:14.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--bf895e48-07bb-4fc5-9c36-7b16c53b9abe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.206.242.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T23:32:09.682Z",
      "x_nadsec_last_seen": "2026-05-26T23:34:14.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-27T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e95ce016-3de7-4dd0-abeb-e810a0b27381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.147.174.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T00:05:10.000Z",
      "valid_until": "2026-06-28T00:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-26T23:59:29.028Z",
      "x_nadsec_last_seen": "2026-05-27T00:01:36.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d8ef06e1-fedd-40a5-b50b-b123d4433d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.207.157.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-27T00:38:20.561Z",
      "x_nadsec_last_seen": "2026-05-27T02:19:27.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d0ce0278-cd04-4ba7-a645-ca668013b0cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.241.149.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T00:25:21.800Z",
      "x_nadsec_last_seen": "2026-05-27T00:25:21.800Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--76b088cc-c8bb-44c6-9668-e6b2f14ee5e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.13.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T00:07:05.206Z",
      "x_nadsec_last_seen": "2026-05-27T00:09:11.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b3bda5f0-9df9-4aab-bf18-7a4650972d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T00:09:22.199Z",
      "x_nadsec_last_seen": "2026-05-27T00:09:22.199Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--00abe1fb-a476-451d-9c8c-d6c691d41e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T00:28:01.175Z",
      "x_nadsec_last_seen": "2026-05-27T00:28:01.175Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--230fa4f7-e9ec-4787-b920-89a16fbb30ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.129.147.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T00:09:32.548Z",
      "x_nadsec_last_seen": "2026-05-27T00:09:36.682Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--47e04933-e953-44ef-9af0-ac91d65e3fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.211.15.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T01:04:27.110Z",
      "x_nadsec_last_seen": "2026-05-27T01:04:27.110Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--3927e64d-32e5-46e4-8183-58915b480219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.245.148.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T01:00:31.302Z",
      "x_nadsec_last_seen": "2026-05-27T01:05:50.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-05-27T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--89e75385-fac7-4ace-bfbd-7a0b5db617e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.109.46.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:05:10.000Z",
      "valid_until": "2026-06-28T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T01:01:25.749Z",
      "x_nadsec_last_seen": "2026-05-27T01:03:32.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--52f97db8-8506-4fd0-a0bc-dc1a914f035e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.171.104.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T01:15:55.688Z",
      "x_nadsec_last_seen": "2026-05-27T01:18:00.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--6addbb3c-f736-4d79-bb76-9d92d356c993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.107.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T01:41:30.234Z",
      "x_nadsec_last_seen": "2026-05-27T01:43:37.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=11432; asn_org=Telium Telecomunicacoes Ltda",
      "id": "indicator--ad5c3ac4-97a2-4593-b133-832a4f2405a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.170.212.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T01:46:16.563Z",
      "x_nadsec_last_seen": "2026-05-27T01:48:23.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "11432"
      ],
      "x_nadsec_orgs": [
        "Telium Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--0c2ef40c-31f5-4767-9a28-06aa527ca533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.248.38.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-27T01:55:49.317Z",
      "x_nadsec_last_seen": "2026-05-27T03:26:44.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--105159cf-0dd6-4a70-bf46-2813d8cba473",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.252.14.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T01:35:19.885Z",
      "x_nadsec_last_seen": "2026-05-27T01:37:23.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--6aee649e-606e-45e0-8cc5-af5d2317beb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.202.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T01:14:24.435Z",
      "x_nadsec_last_seen": "2026-05-27T01:14:24.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GE; asn=20771; asn_org=Caucasus Online Ltd.",
      "id": "indicator--5f9dd401-c5fa-4831-ba18-c84bf05a426f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.241.252.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T01:38:34.914Z",
      "x_nadsec_last_seen": "2026-05-27T01:38:35.250Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "20771"
      ],
      "x_nadsec_orgs": [
        "Caucasus Online Ltd."
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--2bc0ed04-fb02-4c16-b474-c3a883dc0451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.28.111.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T02:00:22.402Z",
      "x_nadsec_last_seen": "2026-05-27T02:00:28.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-27T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=34602; asn_org=Megasvyaz LLC",
      "id": "indicator--49105731-cfef-4103-b30f-8c2a084c9533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.17.146.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:05:10.000Z",
      "valid_until": "2026-06-28T02:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T01:49:37.991Z",
      "x_nadsec_last_seen": "2026-05-27T01:51:44.708Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34602"
      ],
      "x_nadsec_orgs": [
        "Megasvyaz LLC"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--3eba2816-feab-4a01-ab19-ce3684bf77ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.58.198.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-05-27T02:17:59.912Z",
      "x_nadsec_last_seen": "2026-05-27T16:25:45.920Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "1723"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=pptpd; ports=1723; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.82.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-27T02:14:55.468Z",
      "x_nadsec_last_seen": "2026-05-27T02:18:24.178Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "45345"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a411ecd6-135b-4ac0-9354-e2b3e752df2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.163.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T02:51:43.551Z",
      "x_nadsec_last_seen": "2026-05-27T02:51:43.551Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--ac9bdc90-e53b-4972-b337-11c2dbc18da7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.53.206.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T02:45:08.966Z",
      "x_nadsec_last_seen": "2026-05-27T02:45:49.501Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--13c4c5fb-34e0-4fe4-9552-2dc380fffde7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.195.105.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T02:44:43.053Z",
      "x_nadsec_last_seen": "2026-05-27T02:44:43.053Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9ed9acf3-87c9-443d-a875-63d801953d97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.193.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T02:25:28.171Z",
      "x_nadsec_last_seen": "2026-05-27T02:27:35.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--374fef9c-9004-4a6c-ba14-649b1a9a98a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.248.219.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-27T02:41:58.706Z",
      "x_nadsec_last_seen": "2026-05-29T01:59:00.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=3320; asn_org=Deutsche Telekom AG",
      "id": "indicator--1e7c25dc-3eb6-4a8d-bdb2-0d1500b1fda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.157.24.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-27T02:46:01.176Z",
      "x_nadsec_last_seen": "2026-05-31T16:28:09.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "3320"
      ],
      "x_nadsec_orgs": [
        "Deutsche Telekom AG"
      ]
    },
    {
      "created": "2026-05-27T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6a2f5078-26ae-4bd5-93f2-8ce8f89180b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:05:10.000Z",
      "valid_until": "2026-06-28T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T02:32:26.013Z",
      "x_nadsec_last_seen": "2026-05-27T02:32:26.013Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--f5423a27-15e3-4ace-a62e-0b5681f2b360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T03:48:53.903Z",
      "x_nadsec_last_seen": "2026-05-27T09:20:44.837Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC; user(top)=**",
      "id": "indicator--a4cd10d7-39e8-4393-a997-15bd3d1d2bf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.182.217.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T03:45:15.476Z",
      "x_nadsec_last_seen": "2026-05-29T04:24:07.494Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200590"
      ],
      "x_nadsec_orgs": [
        "NLS Kazakhstan LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27964; asn_org=RSO APOLO HIDALGO S.R.L.",
      "id": "indicator--3b0c7254-98d5-4a9e-8f54-0f4d3f96c6ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.4.110.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T03:33:16.868Z",
      "x_nadsec_last_seen": "2026-05-27T03:35:23.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27964"
      ],
      "x_nadsec_orgs": [
        "RSO APOLO HIDALGO S.R.L."
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--8af1def3-9811-4242-8a9f-9112c7e43593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.188.3.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T03:33:41.020Z",
      "x_nadsec_last_seen": "2026-05-27T03:35:46.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T03:05:50.476Z",
      "x_nadsec_last_seen": "2026-05-27T03:05:51.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4ef9d0e0-97bc-4bc4-b38e-c96f0be24d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.80.204.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T03:13:34.853Z",
      "x_nadsec_last_seen": "2026-05-27T03:13:34.853Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ab72717a-7d4e-4058-8adc-a8e0a07ba07f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.223.102.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T03:12:12.454Z",
      "x_nadsec_last_seen": "2026-05-27T03:14:17.363Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-27T04:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=21499; asn_org=Host Europe GmbH",
      "id": "indicator--584f033b-0f84-4b1d-b9be-a87c6edbb86b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T04:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.205.23.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:05:23.000Z",
      "valid_until": "2026-06-28T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T03:49:37.672Z",
      "x_nadsec_last_seen": "2026-05-27T03:49:37.672Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "21499"
      ],
      "x_nadsec_orgs": [
        "Host Europe GmbH"
      ]
    },
    {
      "created": "2026-05-27T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--528b248c-d232-416e-a29e-1dea243f8fa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.194.17.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:05:06.000Z",
      "valid_until": "2026-06-28T05:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-27T05:00:38.513Z",
      "x_nadsec_last_seen": "2026-05-27T06:16:38.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-05-27T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=12338; asn_org=Euskaltel S.A.",
      "id": "indicator--0e6ca603-9b62-4714-8773-557a237910be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.60.70.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:05:06.000Z",
      "valid_until": "2026-06-28T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T04:51:34.659Z",
      "x_nadsec_last_seen": "2026-05-27T04:51:35.284Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12338"
      ],
      "x_nadsec_orgs": [
        "Euskaltel S.A."
      ]
    },
    {
      "created": "2026-05-27T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f0748849-658e-4bf7-bc48-408dc19ab6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:05:06.000Z",
      "valid_until": "2026-06-28T05:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T04:46:15.388Z",
      "x_nadsec_last_seen": "2026-05-27T04:46:16.003Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b3845628-03e8-44a0-b814-05a5ee81d7de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:05:06.000Z",
      "valid_until": "2026-06-28T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T04:34:08.167Z",
      "x_nadsec_last_seen": "2026-05-27T04:34:08.167Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T05:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cbd93c93-ab83-410e-b2db-c26e3b8f7c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T05:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:05:06.000Z",
      "valid_until": "2026-06-28T05:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T04:34:07.077Z",
      "x_nadsec_last_seen": "2026-05-27T04:34:07.077Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133278; asn_org=Dehradun Enet Solutions Private Ltd",
      "id": "indicator--19f5ec92-6a48-46f0-8bc9-9f45eb82ab78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.230.155.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T05:41:19.449Z",
      "x_nadsec_last_seen": "2026-05-27T05:43:25.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133278"
      ],
      "x_nadsec_orgs": [
        "Dehradun Enet Solutions Private Ltd"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b04371e7-f889-4fbc-bba8-2a4f321a2155",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.200.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T05:32:22.642Z",
      "x_nadsec_last_seen": "2026-05-27T05:32:22.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--bcb10b3c-e8de-405f-861a-cb04371697ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.180.201.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T05:16:52.447Z",
      "x_nadsec_last_seen": "2026-05-27T05:18:57.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--71590208-2c1b-4f6f-ade9-1630ba539475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.190.40.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T05:39:08.031Z",
      "x_nadsec_last_seen": "2026-05-27T05:41:14.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1f63a6a0-c9e1-4e5a-a27e-3423bcccfd12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.19.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T05:37:02.924Z",
      "x_nadsec_last_seen": "2026-05-27T05:39:09.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T05:28:53.695Z",
      "x_nadsec_last_seen": "2026-05-27T05:28:53.695Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--de30f9fa-9ae3-4f60-923b-3bb299702b50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T06:00:26.586Z",
      "x_nadsec_last_seen": "2026-05-27T06:00:36.778Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--991a62ef-55bf-4669-9c44-1727ce641f1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T05:07:29.402Z",
      "x_nadsec_last_seen": "2026-05-27T05:07:29.402Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--49b6554b-71f3-4088-bf28-220768122e47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T05:08:53.761Z",
      "x_nadsec_last_seen": "2026-05-27T05:08:53.761Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T05:08:43.552Z",
      "x_nadsec_last_seen": "2026-05-27T05:08:43.552Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--011564ca-3757-47ff-87a9-4f84ab05bf21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.56.225.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:05:06.000Z",
      "valid_until": "2026-06-28T06:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-27T05:38:58.817Z",
      "x_nadsec_last_seen": "2026-05-27T06:04:42.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--56535e4d-2332-4986-8ed8-60b17ae811c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.55.241.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-27T06:27:29.629Z",
      "x_nadsec_last_seen": "2026-05-27T07:54:30.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1dfc83a9-5c66-4972-a45f-9a79dd0cb2aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.186.244.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T06:21:15.733Z",
      "x_nadsec_last_seen": "2026-05-27T06:23:20.493Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a15af852-5deb-408f-9f9d-acc17ab753c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '128.203.204.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T06:34:40.285Z",
      "x_nadsec_last_seen": "2026-05-27T06:34:50.460Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--ab0d827a-d24e-473f-aed2-5bc894a072a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.17.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T06:34:37.515Z",
      "x_nadsec_last_seen": "2026-05-27T06:34:37.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=55805; asn_org=MobiCom Corporation",
      "id": "indicator--8a75f197-86e1-4b79-9945-3520e988d6a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.126.88.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T06:39:35.124Z",
      "x_nadsec_last_seen": "2026-05-27T06:41:42.709Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "55805"
      ],
      "x_nadsec_orgs": [
        "MobiCom Corporation"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--595c0b7a-1c2a-4909-888c-f72c2d4674e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.83.50.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-27T06:12:08.891Z",
      "x_nadsec_last_seen": "2026-05-31T01:08:13.560Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--7f9cb8a4-f910-457e-92da-7092f8b73b74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T06:26:57.542Z",
      "x_nadsec_last_seen": "2026-05-27T06:26:57.542Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--055402f4-2307-44bf-8308-b466c077e331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '48.216.218.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T07:02:38.836Z",
      "x_nadsec_last_seen": "2026-05-27T07:02:38.836Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--dfb04da1-9b7f-496b-9522-7c8aff2a80f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.228.67.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T06:56:25.623Z",
      "x_nadsec_last_seen": "2026-05-27T06:58:30.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-27T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4bbd940a-9564-41bf-8ece-2340057c6bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.250.170.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:05:10.000Z",
      "valid_until": "2026-06-28T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T06:46:25.563Z",
      "x_nadsec_last_seen": "2026-05-27T06:46:26.219Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c48f338c-064a-437a-a3db-d781f25f3a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.252.11.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T07:45:18.421Z",
      "x_nadsec_last_seen": "2026-05-27T07:47:23.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--95158ebb-87bc-4501-8ec2-b5274d624a5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.180.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T07:35:03.337Z",
      "x_nadsec_last_seen": "2026-05-27T07:37:08.930Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--933493f9-8ac6-4f79-886e-f241f5d2012e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.167.141.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T07:28:13.260Z",
      "x_nadsec_last_seen": "2026-05-27T07:30:18.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=US; asn=11427; asn_org=Charter Communications Inc",
      "id": "indicator--fde35f30-1f7e-4c1a-bb8f-9ae98fb599b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.197.14.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-27T07:12:16.539Z",
      "x_nadsec_last_seen": "2026-05-27T07:12:18.525Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11427"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ee6bc55f-d597-4279-8c02-a11120fbb18d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.130.75.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T07:25:48.522Z",
      "x_nadsec_last_seen": "2026-05-27T07:27:54.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--65731fa6-979a-40ab-b108-040dc7c90eeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.240.58.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T07:50:58.052Z",
      "x_nadsec_last_seen": "2026-05-27T07:53:05.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--ac0e57d6-de9b-4dfc-9a56-cd403111afa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-27T07:17:34.561Z",
      "x_nadsec_last_seen": "2026-05-27T07:18:04.100Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5831ca75-4c64-407a-9c66-02b431b574b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.39.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-27T07:37:33.033Z",
      "x_nadsec_last_seen": "2026-05-27T07:37:42.941Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c8d9e4e3-b7a8-4d1c-a486-8bb7e83d2ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.248.56.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T07:50:27.854Z",
      "x_nadsec_last_seen": "2026-05-27T07:52:32.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--1664d349-d511-45c9-bc9d-fa08bda3816e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.101.33.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T07:10:26.197Z",
      "x_nadsec_last_seen": "2026-05-27T07:12:32.452Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-05-27T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AZ; asn=209489; asn_org=Azintex.com LLC",
      "id": "indicator--351c6750-cbe2-4830-83df-41c9531cc870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.20.48.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:05:05.000Z",
      "valid_until": "2026-06-28T08:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T07:47:44.824Z",
      "x_nadsec_last_seen": "2026-05-27T07:55:00.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "209489"
      ],
      "x_nadsec_orgs": [
        "Azintex.com LLC"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--6b2abfbe-41c6-4c02-a8a4-0df8f8f03d89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.165.241.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T09:35:47.704Z",
      "x_nadsec_last_seen": "2026-05-27T09:42:18.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6200749c-d444-4af0-bd16-976f68b114e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.247.243.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T09:09:06.955Z",
      "x_nadsec_last_seen": "2026-05-27T09:09:54.970Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SV; asn=26617; asn_org=Navega.com S.A.",
      "id": "indicator--15a904cc-c200-457d-81ff-7c18aee8132f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.219.159.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T09:53:57.471Z",
      "x_nadsec_last_seen": "2026-05-27T09:56:03.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "26617"
      ],
      "x_nadsec_orgs": [
        "Navega.com S.A."
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=2516; asn_org=KDDI CORPORATION",
      "id": "indicator--9e8672b8-a76d-42b5-a7c4-a6ca15ac3718",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.10.64.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T09:53:00.731Z",
      "x_nadsec_last_seen": "2026-05-27T09:53:05.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2516"
      ],
      "x_nadsec_orgs": [
        "KDDI CORPORATION"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--a90c024e-a4d4-40ee-9502-389958ed3928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.99.57.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T09:31:21.670Z",
      "x_nadsec_last_seen": "2026-05-27T09:32:07.675Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--50320f92-a4f8-4e53-ac9e-bb01a7bb844b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.61.30.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T09:43:23.640Z",
      "x_nadsec_last_seen": "2026-05-27T09:43:23.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--c36d6132-0353-4a56-9473-7cf645b750e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.52.68.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T09:06:06.667Z",
      "x_nadsec_last_seen": "2026-05-27T09:08:11.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263008; asn_org=RIO CABLE CORPORATE LTDA - ME",
      "id": "indicator--81c3cbe4-c7d4-4df8-aaa4-0310a213e390",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.226.214.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T09:36:39.954Z",
      "x_nadsec_last_seen": "2026-05-27T09:38:46.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263008"
      ],
      "x_nadsec_orgs": [
        "RIO CABLE CORPORATE LTDA - ME"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--1da3aca2-23a6-464a-9941-838285c0a977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.141.231.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T09:59:26.755Z",
      "x_nadsec_last_seen": "2026-05-27T10:01:34.149Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8a68e861-1df2-4a5a-b1fb-267d3a85a463",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T10:02:20.938Z",
      "x_nadsec_last_seen": "2026-05-27T10:02:20.938Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--7bec56cd-b638-4e71-badc-ba0f5a80795c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.236.170.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T09:57:59.024Z",
      "x_nadsec_last_seen": "2026-05-27T09:58:22.576Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--fe1c2b21-ca88-4225-af67-954bedf2d52f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.187.46.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T09:45:46.205Z",
      "x_nadsec_last_seen": "2026-05-27T09:45:46.258Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--a35fd072-29ba-46cf-90c6-37bf7f8b1274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.189.128.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T09:59:47.045Z",
      "x_nadsec_last_seen": "2026-05-27T10:06:52.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-27T10:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--198aa355-156d-4696-a1c7-b47f2888fc75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T10:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:05:10.000Z",
      "valid_until": "2026-06-28T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T09:37:38.964Z",
      "x_nadsec_last_seen": "2026-05-27T09:37:38.964Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-27T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--f73e9241-ca01-4e50-b1fc-12404729e83f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.134.171.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:05:05.000Z",
      "valid_until": "2026-06-28T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T10:27:10.680Z",
      "x_nadsec_last_seen": "2026-05-27T10:29:16.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-05-27T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--18858dba-4f42-4ebe-82a3-cd9e37c31c71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.175.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:05:05.000Z",
      "valid_until": "2026-06-28T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T10:49:37.979Z",
      "x_nadsec_last_seen": "2026-05-27T10:51:43.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-27T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--3829a947-59f0-401b-a37a-1be6ca8022e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.255.249.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:05:05.000Z",
      "valid_until": "2026-06-28T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T10:27:22.252Z",
      "x_nadsec_last_seen": "2026-05-27T10:29:28.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-05-27T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fd33d352-6a2c-4a99-984a-92894252e9eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.158.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:05:05.000Z",
      "valid_until": "2026-06-28T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T10:19:52.343Z",
      "x_nadsec_last_seen": "2026-05-27T10:21:57.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--5700a6f6-9b16-47d8-9724-4325863584a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.192.112.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:05:05.000Z",
      "valid_until": "2026-06-28T11:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T10:26:23.115Z",
      "x_nadsec_last_seen": "2026-05-27T10:28:27.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-27T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28300; asn_org=Speed Servicos de Internet Ltda",
      "id": "indicator--a5ac7084-07e1-4064-851e-3469cb765ce4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.97.224.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:05:05.000Z",
      "valid_until": "2026-06-28T11:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-27T10:17:03.506Z",
      "x_nadsec_last_seen": "2026-05-27T11:12:41.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28300"
      ],
      "x_nadsec_orgs": [
        "Speed Servicos de Internet Ltda"
      ]
    },
    {
      "created": "2026-05-27T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e0775727-f3e8-4df0-b338-4776a8724ad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.221.72.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:05:05.000Z",
      "valid_until": "2026-06-28T11:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T10:25:46.085Z",
      "x_nadsec_last_seen": "2026-05-27T10:25:46.085Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--88dc5f3c-3f63-4ed8-8517-546d89bc761e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.96.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T11:23:39.359Z",
      "x_nadsec_last_seen": "2026-05-27T11:25:47.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3e6e654a-e4ee-4a79-adad-5d114634b4e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.176.163.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T11:41:56.805Z",
      "x_nadsec_last_seen": "2026-05-27T11:44:01.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--be5fc062-295c-4bd1-93ee-4d0b91a90c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.164.47.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T11:21:41.516Z",
      "x_nadsec_last_seen": "2026-05-27T11:23:46.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5eac3954-e06e-40de-9a42-380cf8b81e5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.226.145.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T11:41:57.039Z",
      "x_nadsec_last_seen": "2026-05-27T11:41:57.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3a873c81-9a1e-47c2-8b51-1b0cc9548a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.245.179.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T11:13:28.459Z",
      "x_nadsec_last_seen": "2026-05-27T11:13:33.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=134540; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--2d2ada0c-5e5c-4319-9e65-e8a71233d0fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.96.91.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 3146,
      "x_nadsec_first_seen": "2026-05-27T11:24:53.116Z",
      "x_nadsec_last_seen": "2026-05-27T13:28:26.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134540"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=9416; asn_org=Hoshin Multimedia Center Inc.",
      "id": "indicator--4186765f-e51b-44a0-a228-2c62a41c1e86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.235.33.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T11:43:04.194Z",
      "x_nadsec_last_seen": "2026-05-27T11:45:09.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9416"
      ],
      "x_nadsec_orgs": [
        "Hoshin Multimedia Center Inc."
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c82411a1-48f6-41d7-b309-215ebe65f12e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.156.78.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T12:05:01.803Z",
      "x_nadsec_last_seen": "2026-05-27T12:07:08.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--40fde6e0-7217-43d7-b23d-afda5ec03972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.206.228.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T11:44:22.527Z",
      "x_nadsec_last_seen": "2026-05-27T11:46:27.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--a39cdb7b-32f9-4ea6-b02f-a9037ecd3e52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.205.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T11:22:20.897Z",
      "x_nadsec_last_seen": "2026-05-27T11:22:21.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--59f176b7-3775-4083-a141-13559a5c33d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.76.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T11:21:23.820Z",
      "x_nadsec_last_seen": "2026-05-27T11:21:23.820Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--5e552172-1ef7-4a26-bd20-f37cd72931da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T11:43:38.247Z",
      "x_nadsec_last_seen": "2026-05-31T17:01:13.730Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KW; asn=21050; asn_org=Fast Communication Company Ltd",
      "id": "indicator--baccd5e0-89ed-41f4-976b-c7ac71e0d4f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.96.72.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T11:32:26.947Z",
      "x_nadsec_last_seen": "2026-05-27T11:34:34.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "21050"
      ],
      "x_nadsec_orgs": [
        "Fast Communication Company Ltd"
      ]
    },
    {
      "created": "2026-05-27T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--2ddcb891-07cc-4651-8e71-ca64dbe78143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:05:10.000Z",
      "valid_until": "2026-06-28T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T11:07:20.635Z",
      "x_nadsec_last_seen": "2026-05-27T11:07:21.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-27T13:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--dd2df1a0-79f7-4a0a-af06-bd9b096e9d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.119.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:05:14.000Z",
      "valid_until": "2026-06-28T13:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T12:44:29.035Z",
      "x_nadsec_last_seen": "2026-05-27T12:44:59.037Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-27T13:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=QA; asn=8781; asn_org=Ooredoo Q.S.C.",
      "id": "indicator--353ac397-f08c-4077-93d9-a47cfb1079de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.202.4.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:05:14.000Z",
      "valid_until": "2026-06-28T13:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T12:05:41.586Z",
      "x_nadsec_last_seen": "2026-05-27T12:05:46.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "QA"
      ],
      "x_nadsec_asns": [
        "8781"
      ],
      "x_nadsec_orgs": [
        "Ooredoo Q.S.C."
      ]
    },
    {
      "created": "2026-05-27T13:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--6f624473-f654-4434-a91a-7b3b824f36eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.38.175.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:05:14.000Z",
      "valid_until": "2026-06-28T13:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T12:14:40.039Z",
      "x_nadsec_last_seen": "2026-05-27T12:16:44.994Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-27T13:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--35a4d20c-088d-4be1-8f89-ae6037bb8873",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.46.60.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:05:14.000Z",
      "valid_until": "2026-06-28T13:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T12:09:07.487Z",
      "x_nadsec_last_seen": "2026-05-27T12:16:46.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-05-27T13:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=151698; asn_org=GREEN WEB SOFTWARE DEVELOPMENT PRIVATE LIMITED",
      "id": "indicator--9d838f7e-78e1-4917-8ed0-cd62323a9f91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.79.148.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:05:14.000Z",
      "valid_until": "2026-06-28T13:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T12:31:14.974Z",
      "x_nadsec_last_seen": "2026-05-27T12:33:20.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151698"
      ],
      "x_nadsec_orgs": [
        "GREEN WEB SOFTWARE DEVELOPMENT PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-27T13:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--828315a3-dbe1-4e65-87c0-6f692a549b5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '219.73.30.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:05:14.000Z",
      "valid_until": "2026-06-28T13:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T12:48:35.657Z",
      "x_nadsec_last_seen": "2026-05-27T12:50:40.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-27T13:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PL; asn=16342; asn_org=Toya sp.z.o.o",
      "id": "indicator--9b189d53-10c7-424e-9a81-bf898cd4e143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T13:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.182.57.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:05:14.000Z",
      "valid_until": "2026-06-28T13:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T12:18:02.629Z",
      "x_nadsec_last_seen": "2026-05-27T23:58:57.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "16342"
      ],
      "x_nadsec_orgs": [
        "Toya sp.z.o.o"
      ]
    },
    {
      "created": "2026-05-27T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--fb399620-8f92-40f0-9322-a649cc730803",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.4.192.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:05:05.000Z",
      "valid_until": "2026-06-28T14:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T13:29:09.761Z",
      "x_nadsec_last_seen": "2026-05-27T13:31:14.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-27T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--41565801-7ac5-4e56-addf-fc0387b8425a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.19.209.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:05:05.000Z",
      "valid_until": "2026-06-28T14:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T13:39:54.129Z",
      "x_nadsec_last_seen": "2026-05-27T13:39:54.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-27T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--4881cddf-9851-4a1f-89d1-11930c167ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.218.76.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:05:05.000Z",
      "valid_until": "2026-06-28T14:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T13:45:45.147Z",
      "x_nadsec_last_seen": "2026-05-27T13:49:04.943Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-27T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--bddda6e5-5992-4b92-8db5-42e914a74314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.120.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:05:05.000Z",
      "valid_until": "2026-06-28T14:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T13:40:27.310Z",
      "x_nadsec_last_seen": "2026-05-27T13:40:27.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-27T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--df9db77d-5311-4386-9161-1a798ae62b6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.226.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:05:05.000Z",
      "valid_until": "2026-06-28T14:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T13:32:34.822Z",
      "x_nadsec_last_seen": "2026-05-27T13:32:34.822Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-27T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=44056; asn_org=Trytek LLC",
      "id": "indicator--1935be9e-0b14-46f2-ba38-fd50a26209e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.135.236.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:05:05.000Z",
      "valid_until": "2026-06-28T14:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T13:52:49.420Z",
      "x_nadsec_last_seen": "2026-05-27T13:54:55.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44056"
      ],
      "x_nadsec_orgs": [
        "Trytek LLC"
      ]
    },
    {
      "created": "2026-05-27T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--85151ac7-d9a0-4bc3-9c85-95127bbde6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.112.50.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:05:05.000Z",
      "valid_until": "2026-06-28T14:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T13:39:54.253Z",
      "x_nadsec_last_seen": "2026-05-27T13:39:54.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-05-27T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--699966b0-d8ef-4e5d-a4a4-e7e2255e4748",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.100.150.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:05:10.000Z",
      "valid_until": "2026-06-28T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T15:15:31.998Z",
      "x_nadsec_last_seen": "2026-05-27T15:15:31.998Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-27T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:05:10.000Z",
      "valid_until": "2026-06-28T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T15:41:10.252Z",
      "x_nadsec_last_seen": "2026-05-27T15:41:10.252Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--59440d8c-81bb-4131-9cc0-667bd1610b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.164.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:05:10.000Z",
      "valid_until": "2026-06-28T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T15:09:40.690Z",
      "x_nadsec_last_seen": "2026-05-27T15:09:40.690Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--738e05df-d866-42c6-9968-2fad2cc2c424",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.249.60.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:22:58.382Z",
      "x_nadsec_last_seen": "2026-05-27T17:22:58.382Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--679bb244-84e4-460a-a081-b51d23289191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.249.61.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:22:59.934Z",
      "x_nadsec_last_seen": "2026-05-27T17:22:59.934Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c5810723-99a2-4f00-8c0c-dc606538aae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.191.83.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T17:58:06.477Z",
      "x_nadsec_last_seen": "2026-05-27T18:00:11.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--2804aa72-9039-4a23-a441-08ba0d4606c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.172.200.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:23:09.392Z",
      "x_nadsec_last_seen": "2026-05-27T17:23:09.392Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--dd5eb1cd-c338-4431-bdd1-c002142f0427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.178.128.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:23:05.301Z",
      "x_nadsec_last_seen": "2026-05-27T17:23:05.301Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--246df92f-9843-4aa9-b635-743936f0977d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.29.202.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T17:30:53.830Z",
      "x_nadsec_last_seen": "2026-05-27T17:30:53.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--edc88cda-2ee9-406a-b390-3b333b1aaa19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.123.76.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:23:08.112Z",
      "x_nadsec_last_seen": "2026-05-27T17:23:08.112Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T18:03:22.637Z",
      "x_nadsec_last_seen": "2026-05-27T18:03:22.637Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--3c48220a-418c-4baf-a744-f1b79c34eb4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.255.39.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:23:01.323Z",
      "x_nadsec_last_seen": "2026-05-27T17:23:01.323Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bf9b5d5e-690e-485b-931a-99bbf30d874b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.103.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:51:55.203Z",
      "x_nadsec_last_seen": "2026-05-27T17:51:55.203Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--99ad0b7e-a40e-437f-acd6-82eab62f4a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.221.11.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T17:23:13.855Z",
      "x_nadsec_last_seen": "2026-05-27T17:29:06.648Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--4483d9b3-9fed-4858-a90b-513beb843804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.226.9.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:29:36.653Z",
      "x_nadsec_last_seen": "2026-05-27T17:29:36.653Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--b8b54df9-a153-4dde-9f39-8e4b3884b183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.119.224.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:23:06.459Z",
      "x_nadsec_last_seen": "2026-05-27T17:23:06.459Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--038b112f-8f6f-40ea-bb8f-8bf56e7b1366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.121.168.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:54:42.512Z",
      "x_nadsec_last_seen": "2026-05-27T17:54:42.512Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UZ; asn=8193; asn_org=Uzbektelekom Joint Stock Company",
      "id": "indicator--da8cfb83-ab7b-44c3-81e1-db6622ee6001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.203.238.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T17:47:22.380Z",
      "x_nadsec_last_seen": "2026-05-27T17:49:27.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "8193"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=22724; asn_org=PUNTONET S.A.",
      "id": "indicator--cf0b80fe-1b3d-470d-9945-d0ac93b30be2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.57.130.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-05-27T16:27:35.869Z",
      "x_nadsec_last_seen": "2026-05-27T23:24:29.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "22724"
      ],
      "x_nadsec_orgs": [
        "PUNTONET S.A."
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=20207; asn_org=Gigared S.A.",
      "id": "indicator--24271114-7b1d-4f1a-9ca6-764b42057f69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.7.2.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T18:00:41.802Z",
      "x_nadsec_last_seen": "2026-05-27T18:08:27.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "20207"
      ],
      "x_nadsec_orgs": [
        "Gigared S.A."
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=381; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=a***h; pass(top)=a***h",
      "id": "indicator--926ef88b-5158-4487-a3fa-9d6d5eabd296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2794,
      "x_nadsec_first_seen": "2026-05-27T16:38:30.101Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:40.363Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "**",
        "**",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "",
        "1**4",
        "P******d"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=379; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=**; pass(top)=d******A",
      "id": "indicator--99e126df-0f05-4c6e-8950-6d7b4021ec56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2799,
      "x_nadsec_first_seen": "2026-05-27T16:38:28.703Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:39.982Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "t**t",
        "***",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "",
        "P******d",
        "*"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=378; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=**; pass(top)=H*********c",
      "id": "indicator--f3adb647-f78d-4a0a-b872-ebad10f2947d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2795,
      "x_nadsec_first_seen": "2026-05-27T16:38:28.930Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:42.022Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "**",
        "**",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "",
        "*",
        "P******d"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=353; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=**; pass(top)=S****.",
      "id": "indicator--8d14157b-678d-49c4-b9ba-f021ea6e1f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2752,
      "x_nadsec_first_seen": "2026-05-27T16:38:36.445Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:34.094Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "**",
        "**",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "",
        "***",
        "1**4",
        "P******d"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=377; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=**; pass(top)=a*******@",
      "id": "indicator--69e24467-3594-4e1a-b2c0-7af66d00c53f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2807,
      "x_nadsec_first_seen": "2026-05-27T16:38:29.078Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:39.159Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "**",
        "**",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "",
        "***",
        "*",
        "P******d"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=375; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=**; pass(top)=n*****t",
      "id": "indicator--ced04aa0-9dcd-4dc7-b04b-35e47c10fbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2797,
      "x_nadsec_first_seen": "2026-05-27T16:38:30.818Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:49.588Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "**",
        "**",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "",
        "1**4",
        "P******d"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=376; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=***; pass(top)=A*****3",
      "id": "indicator--2b8234ee-6f03-4163-a657-7d4aa3b957ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2811,
      "x_nadsec_first_seen": "2026-05-27T16:38:28.957Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:43.559Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "t**t",
        "***",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "",
        "***",
        "1**4",
        "*"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=378; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=***; pass(top)=***",
      "id": "indicator--c030da3e-5909-45a3-a3e6-d663e2653fb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2814,
      "x_nadsec_first_seen": "2026-05-27T16:38:33.216Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:39.198Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "**",
        "**",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "",
        "***",
        "1**4",
        "P******d"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=377; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=**; pass(top)=J******************d",
      "id": "indicator--83820d0b-905d-4763-9658-ffad59ea5216",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2813,
      "x_nadsec_first_seen": "2026-05-27T16:38:30.588Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:50.194Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "t**t",
        "u**r",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "",
        "1**4",
        "P******d"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=374; services=mssqld; ports=1433; cc=BG; asn=206378; asn_org=FOP Dmytro Nedilskyi; user(top)=**; pass(top)=1**************#",
      "id": "indicator--1c4e9ad5-b332-40f7-9b8f-e3cde118223d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.113.39.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2805,
      "x_nadsec_first_seen": "2026-05-27T16:38:32.989Z",
      "x_nadsec_last_seen": "2026-05-28T08:23:48.438Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "206378"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "**",
        "t**t",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "",
        "P******d",
        "*"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--50098261-9ac9-4741-9e21-ef73a197db11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:15:33.051Z",
      "x_nadsec_last_seen": "2026-05-27T17:15:33.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--6eed7d95-6b3b-4f38-b3ef-1fa57affcb3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:15:33.493Z",
      "x_nadsec_last_seen": "2026-05-27T17:15:33.493Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--f95475c2-d299-4f3a-b92b-86aaf34bbce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.109.232.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T17:14:40.930Z",
      "x_nadsec_last_seen": "2026-05-27T17:16:47.168Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T17:25:46.731Z",
      "x_nadsec_last_seen": "2026-05-27T23:25:38.185Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6a6dbe57-5f3e-4e60-8f9c-44ce94e8fb48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.94.32.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:22:50.209Z",
      "x_nadsec_last_seen": "2026-05-27T17:22:50.209Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=137266; asn_org=CHINATELECOM Hubei province Wuhan 5G network",
      "id": "indicator--4346eac8-a5ff-4e9b-b322-7f3ec359da2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.18.104.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:23:04.041Z",
      "x_nadsec_last_seen": "2026-05-27T17:23:04.041Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "137266"
      ],
      "x_nadsec_orgs": [
        "CHINATELECOM Hubei province Wuhan 5G network"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--96a1cc5a-7934-4551-82e3-a4095699cdae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.76.107.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:51:42.006Z",
      "x_nadsec_last_seen": "2026-05-27T17:51:42.006Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=132559; asn_org=Gatik Business Solutions",
      "id": "indicator--47a32ec8-a507-4996-bbdf-a6abf1c7dc3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.255.85.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T17:44:11.596Z",
      "x_nadsec_last_seen": "2026-05-27T17:44:36.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132559"
      ],
      "x_nadsec_orgs": [
        "Gatik Business Solutions"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--d543e1c4-9c1d-4fe6-94d5-e4ffe7f82cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.143.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:52:23.503Z",
      "x_nadsec_last_seen": "2026-05-27T17:52:23.503Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b9d2eff1-bb05-4ae7-ae63-bb720bd9dcc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.52.103.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:23:10.756Z",
      "x_nadsec_last_seen": "2026-05-27T17:23:10.756Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3be643ea-c439-4440-8c97-28760395eda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.24.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T17:52:02.299Z",
      "x_nadsec_last_seen": "2026-05-29T14:55:05.346Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--4add08bc-ea89-4fc4-8d51-7d0502051ea7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.43.71.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T17:15:48.190Z",
      "x_nadsec_last_seen": "2026-05-27T17:17:54.525Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-05-27T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--540a5209-ba64-4925-b545-210d72727303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:05:10.000Z",
      "valid_until": "2026-06-28T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T17:57:36.036Z",
      "x_nadsec_last_seen": "2026-05-27T17:57:36.036Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--11e3e12d-4dfa-4919-a7cb-64188b29b465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.139.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T18:54:56.559Z",
      "x_nadsec_last_seen": "2026-05-27T18:55:16.022Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--ee512568-d396-462e-a08b-b0d24af60899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.135.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T18:54:31.605Z",
      "x_nadsec_last_seen": "2026-05-27T18:56:38.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6d2b3269-f70b-4658-8d2a-9f4fe35a255c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.33.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T18:07:24.962Z",
      "x_nadsec_last_seen": "2026-05-27T18:07:49.699Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--11451054-969e-4d55-9150-04361c468977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.224.142.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T19:03:12.032Z",
      "x_nadsec_last_seen": "2026-05-27T19:03:12.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd",
      "id": "indicator--5ba4ec8b-f30c-49cd-bd74-2f6e8ead9120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.79.60.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T18:41:55.820Z",
      "x_nadsec_last_seen": "2026-05-27T18:44:00.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ece707e1-df3c-4035-9dad-083951faff33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T18:39:12.762Z",
      "x_nadsec_last_seen": "2026-05-27T18:39:14.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--be430f6a-d388-49e3-b852-858e2aa7c8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.171.132.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T18:40:52.319Z",
      "x_nadsec_last_seen": "2026-05-27T18:48:04.804Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--2e872248-5c0f-4af3-934b-441a529717f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.75.165.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T18:16:29.062Z",
      "x_nadsec_last_seen": "2026-05-27T18:17:18.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57737; asn_org=Joint Stock Company Angarsk Electrolysis Chemical Complex",
      "id": "indicator--1b1b1deb-f92e-49b8-9eb5-510d627b7de2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.234.172.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T18:55:09.721Z",
      "x_nadsec_last_seen": "2026-05-27T18:57:16.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57737"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company Angarsk Electrolysis Chemical Complex"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3c43ed44-ac38-4142-8826-5bc8dfeba74f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T18:42:57.213Z",
      "x_nadsec_last_seen": "2026-05-27T18:42:57.213Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--13f04f0d-4e10-4b39-a8f2-e40e59fbe5c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T18:42:31.167Z",
      "x_nadsec_last_seen": "2026-05-27T18:42:31.167Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3e32050d-32f0-4d2d-acae-e40f449503b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:05:10.000Z",
      "valid_until": "2026-06-28T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T18:42:57.405Z",
      "x_nadsec_last_seen": "2026-05-27T18:42:57.405Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=TH; asn=17552; asn_org=True Online",
      "id": "indicator--901b1bcd-0d93-475c-88ad-3f943f2e0943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.121.169.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-27T19:09:18.423Z",
      "x_nadsec_last_seen": "2026-05-27T19:34:55.773Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "17552"
      ],
      "x_nadsec_orgs": [
        "True Online"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--df092d69-678b-48d8-ac62-3831f01a96a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.74.56.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T19:36:13.037Z",
      "x_nadsec_last_seen": "2026-05-27T19:36:43.038Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--50fcff65-4127-4241-8e5a-78e0e5985774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.184.108.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T19:36:54.159Z",
      "x_nadsec_last_seen": "2026-05-27T19:39:00.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--008e660c-7260-4723-8365-f13b0ba5426a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T19:10:35.595Z",
      "x_nadsec_last_seen": "2026-05-27T19:10:35.595Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--0a951788-4067-4851-8f95-b4750dd04c4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-05-27T19:09:22.779Z",
      "x_nadsec_last_seen": "2026-05-27T21:34:37.302Z",
      "x_nadsec_ports": [
        "27017",
        "81"
      ],
      "x_nadsec_services": [
        "mongod",
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--bd5e3156-5714-418f-8dca-11a577a6d947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.139.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T19:22:11.714Z",
      "x_nadsec_last_seen": "2026-05-27T19:22:29.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HU; asn=9009; asn_org=M247 Europe SRL",
      "id": "indicator--fdda5bbb-9495-4a44-939d-401586ea37b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.106.74.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T19:51:29.478Z",
      "x_nadsec_last_seen": "2026-05-27T19:51:29.478Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ]
    },
    {
      "created": "2026-05-27T20:06:31.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--14f2b716-5897-4c33-877b-8446baff27b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T20:06:31.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.247.12.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:06:31.000Z",
      "valid_until": "2026-06-28T20:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T19:49:23.970Z",
      "x_nadsec_last_seen": "2026-05-27T19:56:35.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138239; asn_org=Vaishnavi Online Internet Services Pvt. Ltd.",
      "id": "indicator--b73ffff4-54d5-4f83-8552-37782a908075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.126.205.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T20:11:15.857Z",
      "x_nadsec_last_seen": "2026-05-27T20:13:20.482Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138239"
      ],
      "x_nadsec_orgs": [
        "Vaishnavi Online Internet Services Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--0cf9a0b6-05cc-4ca2-b747-4ceec9802d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.253.141.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T20:37:11.911Z",
      "x_nadsec_last_seen": "2026-05-27T20:43:52.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--7f63f0ac-792e-42a6-8bec-b1af6cf7c1fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.177.36.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T20:20:51.409Z",
      "x_nadsec_last_seen": "2026-05-27T20:22:56.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--ee244a79-28ba-4d96-a011-0af8de2bc3b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.201.6.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T20:16:24.873Z",
      "x_nadsec_last_seen": "2026-05-27T20:16:24.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1c898345-58c9-4793-8164-364f851caa0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.38.20.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T20:11:28.988Z",
      "x_nadsec_last_seen": "2026-05-27T20:11:28.988Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f4d32c38-20b3-464e-886f-91f53bf14258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T20:54:35.052Z",
      "x_nadsec_last_seen": "2026-05-27T20:54:35.052Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ea01a56c-483c-465c-a680-6e7b4b6af095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T20:54:34.385Z",
      "x_nadsec_last_seen": "2026-05-27T20:54:34.385Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--65cf1d75-a3e0-4ddb-aebe-c2f6087e3afd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T20:54:55.736Z",
      "x_nadsec_last_seen": "2026-05-27T20:54:55.736Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f7334936-d8e2-4f59-82cf-9ab04519a416",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:05:10.000Z",
      "valid_until": "2026-06-28T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T20:55:06.117Z",
      "x_nadsec_last_seen": "2026-05-27T20:55:06.117Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--010207a8-a502-4dad-af58-d885b1c0cc54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.20.145.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T21:33:10.069Z",
      "x_nadsec_last_seen": "2026-05-27T21:39:54.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ac61c4aa-9356-46b0-91a6-568786ee1633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.165.136.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T21:05:54.702Z",
      "x_nadsec_last_seen": "2026-05-27T21:07:59.768Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--1241c77d-e21b-4258-8098-81394d825055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.96.136.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-27T21:57:43.826Z",
      "x_nadsec_last_seen": "2026-05-27T22:53:56.373Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--b8173d4f-66cc-4b1a-927c-dcd2adac34ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.232.47.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T21:54:04.151Z",
      "x_nadsec_last_seen": "2026-05-27T21:54:04.151Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--91f296e8-b62f-47bf-ac6f-1cfcb8d76b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T21:58:06.543Z",
      "x_nadsec_last_seen": "2026-05-27T21:58:06.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--90e5f2aa-ac27-4126-bb1d-67d72ae96b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T21:05:36.144Z",
      "x_nadsec_last_seen": "2026-05-27T21:05:36.144Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47156; asn_org=Malnet LTD.",
      "id": "indicator--cab205af-7b7e-43e3-a8d3-57d0b24d941d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.188.204.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T21:34:44.304Z",
      "x_nadsec_last_seen": "2026-05-27T21:34:50.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47156"
      ],
      "x_nadsec_orgs": [
        "Malnet LTD."
      ]
    },
    {
      "created": "2026-05-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GE; asn=35805; asn_org=JSC Silknet; user(top)=**",
      "id": "indicator--2e1dff0b-32d8-43bc-bb10-7ee06da9b545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.43.132.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:05:02.000Z",
      "valid_until": "2026-06-28T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T21:18:02.589Z",
      "x_nadsec_last_seen": "2026-05-27T21:18:02.589Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-27T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d76f9f28-86f9-4ac9-ac29-5871312412ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-27T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.80.203.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:05:10.000Z",
      "valid_until": "2026-06-28T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T22:21:38.252Z",
      "x_nadsec_last_seen": "2026-05-27T22:21:38.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--b5baed3a-bd3e-4ac8-a206-5ac25574fedd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.54.13.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T23:37:09.823Z",
      "x_nadsec_last_seen": "2026-05-27T23:39:15.295Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--2cf5451e-a72a-440f-9c3b-4c51481eea7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.19.72.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T23:47:21.807Z",
      "x_nadsec_last_seen": "2026-05-27T23:49:28.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--87abdd45-092d-4b6e-bc40-2f4693223930",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.170.0.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-28T00:02:45.179Z",
      "x_nadsec_last_seen": "2026-05-30T18:52:54.250Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--a6ac0a74-9b2d-4dbd-8686-9938211c5a90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.21.171.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T23:34:29.493Z",
      "x_nadsec_last_seen": "2026-05-27T23:36:37.153Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--40557a71-43db-4ad3-97e2-fa8502686c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T23:14:21.631Z",
      "x_nadsec_last_seen": "2026-05-27T23:14:21.631Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--a5ad1035-cfb5-45b2-ba8a-c02c70e75077",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.41.188.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-27T23:46:08.233Z",
      "x_nadsec_last_seen": "2026-05-27T23:48:14.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10834"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--94d55a57-53e6-4f39-b1d5-4529f8b512de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.164.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-27T23:43:21.691Z",
      "x_nadsec_last_seen": "2026-05-27T23:43:21.691Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-28T00:06:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=21497; asn_org=PrJSC VF UKRAINE",
      "id": "indicator--1f298df0-5ba7-4948-96b2-9bdafc077f01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T00:06:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.52.196.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:06:56.000Z",
      "valid_until": "2026-06-29T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-27T23:16:38.751Z",
      "x_nadsec_last_seen": "2026-05-27T23:23:41.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "21497"
      ],
      "x_nadsec_orgs": [
        "PrJSC VF UKRAINE"
      ]
    },
    {
      "created": "2026-05-28T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6a276940-fa49-4e03-9d04-bf5124bce06d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.194.185.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:05:36.000Z",
      "valid_until": "2026-06-29T01:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T00:35:28.292Z",
      "x_nadsec_last_seen": "2026-05-28T00:37:33.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-28T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--d8db8e69-b013-44ce-9e2d-aa70f1961b5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.3.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:05:36.000Z",
      "valid_until": "2026-06-29T01:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-28T00:28:07.149Z",
      "x_nadsec_last_seen": "2026-05-28T01:32:50.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-28T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--37ede4ff-7597-4084-90f2-4cf32f2d71c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.91.20.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:05:36.000Z",
      "valid_until": "2026-06-29T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T00:50:38.401Z",
      "x_nadsec_last_seen": "2026-05-28T00:50:38.401Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c356afeb-4d28-4153-ae45-83d2218c4bb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.187.51.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:05:36.000Z",
      "valid_until": "2026-06-29T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T00:59:52.266Z",
      "x_nadsec_last_seen": "2026-05-28T01:07:02.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--da745b2b-7130-4692-a738-0e5c9fbe1cec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.38.103.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T01:57:41.420Z",
      "x_nadsec_last_seen": "2026-05-28T01:59:49.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0b81bb7d-8f38-4e87-b414-b22bb3376e1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T01:20:23.794Z",
      "x_nadsec_last_seen": "2026-05-28T01:20:24.145Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--62cede67-189b-4662-b4a7-dbf933755260",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.191.196.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T01:23:41.666Z",
      "x_nadsec_last_seen": "2026-05-28T01:25:46.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--2f6192c5-6955-4416-831e-898de101a3b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.237.109.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T01:08:36.933Z",
      "x_nadsec_last_seen": "2026-05-28T01:15:02.275Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--6f614d8e-8bb3-440a-aa60-df0c79e7e4de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.177.239.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T02:04:08.968Z",
      "x_nadsec_last_seen": "2026-05-28T02:14:18.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=203542; asn_org=It-prof LLC",
      "id": "indicator--4a026e31-1c9f-4060-8c0d-9cffb432c1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.213.79.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T01:51:01.658Z",
      "x_nadsec_last_seen": "2026-05-28T01:55:28.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "203542"
      ],
      "x_nadsec_orgs": [
        "It-prof LLC"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--96199207-705d-4f19-959a-3d53c9a0a8bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.45.94.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T01:12:08.415Z",
      "x_nadsec_last_seen": "2026-05-28T01:19:25.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--649424db-3a81-4ddf-ba3f-aaa92c0f96a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.75.46.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T01:24:28.453Z",
      "x_nadsec_last_seen": "2026-05-28T01:26:34.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--317b0e6c-e366-4a1f-a7de-c048424c7b88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.128.241.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-28T01:14:45.458Z",
      "x_nadsec_last_seen": "2026-05-29T02:29:45.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24088"
      ],
      "x_nadsec_orgs": [
        "Hanoi Telecom Joint Stock Company - HCMC Branch"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=24527; asn_org=PT Hanasta Dakara",
      "id": "indicator--fc3d1b17-ef5f-4e5b-9743-d9159d12e979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.160.61.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T01:15:39.587Z",
      "x_nadsec_last_seen": "2026-05-28T01:22:02.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24527"
      ],
      "x_nadsec_orgs": [
        "PT Hanasta Dakara"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--979fc355-bb49-4d84-83f4-1652bd4a1b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.73.37.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T01:51:56.404Z",
      "x_nadsec_last_seen": "2026-05-28T01:51:56.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=35089; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--5139945c-9ee1-4e9b-bd1b-fedafc5118ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T01:19:56.683Z",
      "x_nadsec_last_seen": "2026-05-28T01:19:56.686Z",
      "x_nadsec_ports": [
        "42",
        "35089"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=13768; asn_org=Aptum Technologies",
      "id": "indicator--0e7a4215-8cc3-4dfe-b645-1187e37f115b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '76.74.145.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T01:21:22.506Z",
      "x_nadsec_last_seen": "2026-05-28T01:23:27.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "13768"
      ],
      "x_nadsec_orgs": [
        "Aptum Technologies"
      ]
    },
    {
      "created": "2026-05-28T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2187; services=smbd; ports=445; cc=XK; asn=33983; asn_org=Artmotion Sh.p.k.",
      "id": "indicator--67557ab3-0f09-4726-a352-73c90e59ba49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.22.38.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:05:10.000Z",
      "valid_until": "2026-06-29T02:05:09.000Z",
      "x_nadsec_event_count": 3155,
      "x_nadsec_first_seen": "2026-05-28T01:30:23.502Z",
      "x_nadsec_last_seen": "2026-05-28T02:19:24.050Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "33983"
      ],
      "x_nadsec_orgs": [
        "Artmotion Sh.p.k."
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--c32f7cee-7bbc-4c18-8c92-569ed8194428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.54.21.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T02:40:55.025Z",
      "x_nadsec_last_seen": "2026-05-28T02:48:18.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--6b5f6ac4-3d9e-4aef-ab3c-9d5f56835d57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T02:46:54.913Z",
      "x_nadsec_last_seen": "2026-05-28T02:48:12.284Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--758c942f-c905-4030-87af-9ccf1b41d00f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T02:47:01.432Z",
      "x_nadsec_last_seen": "2026-05-28T02:47:56.757Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--06c25a7b-6934-4219-acab-d1d0a62479e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T02:47:12.519Z",
      "x_nadsec_last_seen": "2026-05-28T02:48:01.759Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--90918056-9489-4cbb-9a87-8c40cb2e19a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T02:47:04.516Z",
      "x_nadsec_last_seen": "2026-05-28T02:47:32.142Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--545aabf5-372b-4914-aa91-4230435ffbbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.56.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T02:19:26.925Z",
      "x_nadsec_last_seen": "2026-05-28T02:23:51.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=134762; asn_org=CHINANET Liaoning province Dalian MAN network",
      "id": "indicator--643c7d9c-7371-4c1f-87f9-ae2551ee3593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.185.87.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T02:47:58.568Z",
      "x_nadsec_last_seen": "2026-05-28T02:52:07.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134762"
      ],
      "x_nadsec_orgs": [
        "CHINANET Liaoning province Dalian MAN network"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=3484; asn_org=Instituto Politecnico Nacional",
      "id": "indicator--1bb7035b-9c00-4e12-9635-4ab8529aafe8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.204.150.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T02:45:20.698Z",
      "x_nadsec_last_seen": "2026-05-28T02:47:25.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "3484"
      ],
      "x_nadsec_orgs": [
        "Instituto Politecnico Nacional"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--0646ebf0-63a8-4db6-a897-7caa907a1c15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '16.59.123.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-28T02:42:28.907Z",
      "x_nadsec_last_seen": "2026-05-28T02:51:53.881Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PA; asn=18809; asn_org=Cable Onda",
      "id": "indicator--e7c81616-0c31-42f5-801a-2fbbf5dfa649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.122.167.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T03:01:13.654Z",
      "x_nadsec_last_seen": "2026-05-28T03:08:18.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "18809"
      ],
      "x_nadsec_orgs": [
        "Cable Onda"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf23f28f-af59-445f-af94-9dadc1223a99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T02:46:09.429Z",
      "x_nadsec_last_seen": "2026-05-28T02:46:09.429Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NL; asn=49453; asn_org=Global Layer B.V.",
      "id": "indicator--2fc9c82e-79d3-49c8-a160-a675a99833c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.152.176.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T02:06:32.516Z",
      "x_nadsec_last_seen": "2026-05-28T02:06:39.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49453"
      ],
      "x_nadsec_orgs": [
        "Global Layer B.V."
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--ba0f8372-f616-4df9-8597-9283f3841e53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.126.227.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T02:25:11.719Z",
      "x_nadsec_last_seen": "2026-05-28T02:27:17.002Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--de100b42-7369-48a1-8f95-5fd38c44ccf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.93.197.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T02:12:44.197Z",
      "x_nadsec_last_seen": "2026-05-28T02:12:44.197Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=136841; asn_org=PT MITRA TELEMEDIA MANUNGGAL",
      "id": "indicator--cb07e1a1-b89c-4a9d-b1a2-fbf35e40e5a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.86.221.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T02:31:50.980Z",
      "x_nadsec_last_seen": "2026-05-28T02:31:50.980Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136841"
      ],
      "x_nadsec_orgs": [
        "PT MITRA TELEMEDIA MANUNGGAL"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=136841; asn_org=PT MITRA TELEMEDIA MANUNGGAL",
      "id": "indicator--17eeafa5-40a0-4f37-be67-f6ac67565194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.86.221.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T02:31:51.232Z",
      "x_nadsec_last_seen": "2026-05-28T02:31:51.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136841"
      ],
      "x_nadsec_orgs": [
        "PT MITRA TELEMEDIA MANUNGGAL"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--150964df-9428-44e5-8dff-08a38e0d8e9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.15.79.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-28T02:13:28.753Z",
      "x_nadsec_last_seen": "2026-05-28T02:19:45.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--4bc94017-ebcf-43a3-8f95-8f4f648474da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.250.196.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T02:57:30.782Z",
      "x_nadsec_last_seen": "2026-05-28T02:59:39.179Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "58224"
      ],
      "x_nadsec_orgs": [
        "Iran Telecommunication Company PJS"
      ]
    },
    {
      "created": "2026-05-28T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--65142742-1820-45ea-aa9b-99f32852b56f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T03:05:10.000Z",
      "valid_until": "2026-06-29T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T03:04:14.004Z",
      "x_nadsec_last_seen": "2026-05-28T03:04:15.987Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; user(top)=**",
      "id": "indicator--d8631204-cea7-4d7d-b630-964d4f5d315a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.15.14.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T03:39:02.009Z",
      "x_nadsec_last_seen": "2026-05-28T03:39:02.009Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--faed3678-23bb-439d-ba70-b357c22056d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.172.204.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T03:31:58.579Z",
      "x_nadsec_last_seen": "2026-05-28T03:34:03.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--4a1092c6-6e7a-4fd9-bf50-4c625c5b04e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.251.181.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T03:47:08.583Z",
      "x_nadsec_last_seen": "2026-05-30T04:40:50.019Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--135ebce8-1c4e-4787-adfe-cfe562247b4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.173.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T03:21:20.676Z",
      "x_nadsec_last_seen": "2026-05-28T03:23:25.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ae027052-7b83-404d-9c64-21036a92557c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T03:53:37.069Z",
      "x_nadsec_last_seen": "2026-05-30T02:30:36.936Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bc6e4a11-0ca5-437c-bbc7-d612da0ffe57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T04:02:01.964Z",
      "x_nadsec_last_seen": "2026-05-28T04:02:02.405Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--11d412cb-fc88-4678-aac9-a0bc854baabc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.38.231.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T03:58:57.911Z",
      "x_nadsec_last_seen": "2026-05-28T03:59:41.927Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--c2fcb54f-0d43-4257-8374-a346496f813e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.241.187.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T03:58:03.967Z",
      "x_nadsec_last_seen": "2026-05-28T03:58:03.967Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b428a7ba-639e-4b3f-83f9-4ab846f926e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.74.77.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T03:57:04.357Z",
      "x_nadsec_last_seen": "2026-05-28T04:03:24.984Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-28T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--152dc516-7fc5-4c06-88d7-845a4aee09d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.228.240.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:05:11.000Z",
      "valid_until": "2026-06-29T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T03:40:46.021Z",
      "x_nadsec_last_seen": "2026-05-28T03:42:50.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-05-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135247; asn_org=K Net Solutions Pvt Ltd",
      "id": "indicator--6581586d-68fb-44ae-bde8-3dad6cbad269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.219.207.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:05:10.000Z",
      "valid_until": "2026-06-29T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T04:09:25.846Z",
      "x_nadsec_last_seen": "2026-05-28T04:11:30.380Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135247"
      ],
      "x_nadsec_orgs": [
        "K Net Solutions Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--121ba137-350c-4571-b692-d45e62db4c86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.194.133.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:05:10.000Z",
      "valid_until": "2026-06-29T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T04:17:07.579Z",
      "x_nadsec_last_seen": "2026-05-28T04:17:13.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e2129849-33a3-4156-865d-bf93a7f95060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.22.42.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:05:10.000Z",
      "valid_until": "2026-06-29T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T05:03:01.831Z",
      "x_nadsec_last_seen": "2026-05-28T05:05:07.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=MX; asn=265523; asn_org=Sierra Madre Internet SA de CV",
      "id": "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.125.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:05:10.000Z",
      "valid_until": "2026-06-29T05:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-28T04:53:04.910Z",
      "x_nadsec_last_seen": "2026-05-28T04:54:28.802Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265523"
      ],
      "x_nadsec_orgs": [
        "Sierra Madre Internet SA de CV"
      ]
    },
    {
      "created": "2026-05-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8570; asn_org=Rostelecom",
      "id": "indicator--2c9717a3-54ae-422c-9698-55942832a6eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.234.37.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:05:10.000Z",
      "valid_until": "2026-06-29T05:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T04:44:15.660Z",
      "x_nadsec_last_seen": "2026-05-28T04:52:06.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8570"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-28T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14103; asn_org=ACD.net",
      "id": "indicator--8fab25a5-bca5-4b86-a78b-c491f7c1a9da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '69.2.27.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:05:10.000Z",
      "valid_until": "2026-06-29T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T04:27:39.816Z",
      "x_nadsec_last_seen": "2026-05-28T04:29:45.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14103"
      ],
      "x_nadsec_orgs": [
        "ACD.net"
      ]
    },
    {
      "created": "2026-05-28T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.51.6.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:05:10.000Z",
      "valid_until": "2026-06-29T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T05:42:13.825Z",
      "x_nadsec_last_seen": "2026-05-28T05:42:13.825Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--63f9e387-707c-4f4e-867e-93e0b2b0cdf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.138.137.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:05:10.000Z",
      "valid_until": "2026-06-29T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T05:11:28.388Z",
      "x_nadsec_last_seen": "2026-05-28T05:13:33.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-28T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d96873f3-c6a6-4c28-94c2-231b470a00f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.225.47.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:05:10.000Z",
      "valid_until": "2026-06-29T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T05:45:25.908Z",
      "x_nadsec_last_seen": "2026-05-28T05:45:25.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-28T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--e423ddee-1a00-4100-b04d-38cdbc30189c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.43.237.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:05:10.000Z",
      "valid_until": "2026-06-29T06:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-28T05:37:10.292Z",
      "x_nadsec_last_seen": "2026-05-28T10:09:17.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-05-28T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--237e5344-7c34-4362-8335-758729c55a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:05:10.000Z",
      "valid_until": "2026-06-29T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T05:06:59.386Z",
      "x_nadsec_last_seen": "2026-05-28T05:07:09.546Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--60d017ee-3f6f-49da-8946-fb92d6020da8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.230.245.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:05:10.000Z",
      "valid_until": "2026-06-29T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T05:08:20.080Z",
      "x_nadsec_last_seen": "2026-05-28T05:14:55.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-28T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=43567; asn_org=UG-TELECOM Ltd.",
      "id": "indicator--3ac7fae6-20eb-42e4-8eed-cef292e84526",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.73.90.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T06:05:10.000Z",
      "valid_until": "2026-06-29T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T06:01:38.193Z",
      "x_nadsec_last_seen": "2026-05-28T06:03:44.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43567"
      ],
      "x_nadsec_orgs": [
        "UG-TELECOM Ltd."
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--42f23870-1e39-44bd-8f69-33513fd237cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.238.70.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T06:34:03.038Z",
      "x_nadsec_last_seen": "2026-05-28T06:36:07.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24088"
      ],
      "x_nadsec_orgs": [
        "Hanoi Telecom Joint Stock Company - HCMC Branch"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--eed63b19-ba2c-43b6-9356-3bf415f5c83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.240.242.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T06:35:47.367Z",
      "x_nadsec_last_seen": "2026-05-28T06:40:15.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=149419; asn_org=A.A Networks PVT Ltd",
      "id": "indicator--d243aeb4-a2ba-4030-8259-c176b023989a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.186.118.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T06:27:59.050Z",
      "x_nadsec_last_seen": "2026-05-28T08:57:38.376Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "149419"
      ],
      "x_nadsec_orgs": [
        "A.A Networks PVT Ltd"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--b2b184ae-3b7c-47af-b74f-1e23defca754",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.64.77.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T06:15:05.558Z",
      "x_nadsec_last_seen": "2026-05-28T06:15:05.558Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--b949d6b6-5001-4a9a-b97e-e148a14c9471",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.169.236.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T06:18:17.093Z",
      "x_nadsec_last_seen": "2026-05-28T06:25:50.246Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--61819121-b9cf-4688-989d-9c64530ab605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.48.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T07:03:34.110Z",
      "x_nadsec_last_seen": "2026-05-28T07:03:34.110Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--321f6698-d551-4c57-9505-dc8b07271e73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.217.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T06:38:53.643Z",
      "x_nadsec_last_seen": "2026-05-28T06:38:53.643Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--1996c168-4a34-430e-94f7-17383b1fa311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.249.14.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T06:18:09.544Z",
      "x_nadsec_last_seen": "2026-05-28T06:18:15.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=36937; asn_org=Neotel",
      "id": "indicator--1242eca2-be8c-42d6-821f-1d2ee988965a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.164.28.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T06:48:23.786Z",
      "x_nadsec_last_seen": "2026-05-28T06:50:31.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36937"
      ],
      "x_nadsec_orgs": [
        "Neotel"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7593deeb-394a-4832-afc2-b2d2f6d92a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.158.95.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T06:20:47.742Z",
      "x_nadsec_last_seen": "2026-05-28T06:29:22.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--b24df556-6e13-401d-a418-813df12f6392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.206.202.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T06:25:59.823Z",
      "x_nadsec_last_seen": "2026-05-28T06:32:39.162Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=23158; asn_org=ETEX COMMUNICATIONS, LLC",
      "id": "indicator--179b7134-2eda-409b-bab7-1f8884793112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.221.144.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T07:00:59.154Z",
      "x_nadsec_last_seen": "2026-05-28T07:03:04.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "23158"
      ],
      "x_nadsec_orgs": [
        "ETEX COMMUNICATIONS, LLC"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12739; asn_org=JSC Netline",
      "id": "indicator--b5abe24a-0f5f-4629-b4bb-e185decb4550",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.90.1.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T06:43:42.307Z",
      "x_nadsec_last_seen": "2026-05-28T06:44:56.378Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12739"
      ],
      "x_nadsec_orgs": [
        "JSC Netline"
      ]
    },
    {
      "created": "2026-05-28T07:05:55.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=GB; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--62ba3f1b-8218-4a82-a9f9-65ee2a97fcea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T07:05:55.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T07:05:55.000Z",
      "valid_until": "2026-06-29T07:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T06:13:56.568Z",
      "x_nadsec_last_seen": "2026-05-28T06:13:56.568Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--0dbb1265-d253-43b1-a71b-df256c22ae48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.174.9.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T07:52:55.395Z",
      "x_nadsec_last_seen": "2026-05-28T07:59:54.880Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AZ; asn=57293; asn_org=AG Telekom MMC.",
      "id": "indicator--7f54530f-12c1-45e4-89a8-fd7dc2fcf146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.255.155.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T07:32:17.746Z",
      "x_nadsec_last_seen": "2026-05-28T07:39:21.133Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "57293"
      ],
      "x_nadsec_orgs": [
        "AG Telekom MMC."
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=27882; asn_org=Telefonica Celular de Bolivia S.A.",
      "id": "indicator--b2444b9d-8bc1-433a-8271-bf7f454665fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.222.97.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T07:49:36.921Z",
      "x_nadsec_last_seen": "2026-05-28T07:57:08.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "27882"
      ],
      "x_nadsec_orgs": [
        "Telefonica Celular de Bolivia S.A."
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--27aa797d-91e1-4343-b2ac-ae290b3c715b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.23.83.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-28T07:41:13.580Z",
      "x_nadsec_last_seen": "2026-05-30T08:25:07.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--72e30063-a423-41ac-80d7-14cef35df29e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.17.182.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T07:54:09.404Z",
      "x_nadsec_last_seen": "2026-05-28T07:56:11.909Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--59596866-caba-4832-ae80-7ca9fb429254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.219.238.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T07:48:41.762Z",
      "x_nadsec_last_seen": "2026-05-28T07:50:48.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HU; asn=35311; asn_org=PR-TELECOM Zrt.",
      "id": "indicator--6ee27039-63d1-4fa9-af28-69a5419627e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.132.96.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T07:13:33.118Z",
      "x_nadsec_last_seen": "2026-05-28T07:15:39.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "35311"
      ],
      "x_nadsec_orgs": [
        "PR-TELECOM Zrt."
      ]
    },
    {
      "created": "2026-05-28T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--363ba297-fb4f-4285-8253-8cc9c965d2dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.247.20.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T08:05:10.000Z",
      "valid_until": "2026-06-29T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T07:16:38.377Z",
      "x_nadsec_last_seen": "2026-05-28T07:16:38.377Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--8ffa1297-efa3-4810-bf7c-a450553ead74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.117.31.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T08:48:59.530Z",
      "x_nadsec_last_seen": "2026-05-28T08:51:04.026Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134032; asn_org=INFONET COMM ENTERPRISES",
      "id": "indicator--d2bcd02c-7488-4e65-bb03-efd49097cd03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.163.45.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T08:47:26.513Z",
      "x_nadsec_last_seen": "2026-05-28T08:49:31.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134032"
      ],
      "x_nadsec_orgs": [
        "INFONET COMM ENTERPRISES"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=56272; asn_org=Pulse Telesystems Pvt Ltd",
      "id": "indicator--1f53d2af-bf55-47e4-8062-31b43e9d22eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.249.81.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T08:17:14.839Z",
      "x_nadsec_last_seen": "2026-05-28T08:19:19.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "56272"
      ],
      "x_nadsec_orgs": [
        "Pulse Telesystems Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--1e814aa5-997d-4aa4-884c-f75103d1c83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.183.50.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T08:05:34.289Z",
      "x_nadsec_last_seen": "2026-05-28T08:07:39.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4432fb1a-ed83-46af-abd3-cb8001e862e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.161.70.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T08:09:11.619Z",
      "x_nadsec_last_seen": "2026-05-28T08:09:15.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--3eeea2b1-bd33-4fdf-af42-eab1e5712f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.31.42.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T08:49:41.097Z",
      "x_nadsec_last_seen": "2026-05-28T08:51:45.607Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--17467e82-89a9-458c-90d7-14b87ed7caea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.204.177.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T09:00:34.661Z",
      "x_nadsec_last_seen": "2026-05-28T09:00:41.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=198953; asn_org=Proton66 OOO; user(top)=**; pass(top)=s********s",
      "id": "indicator--33756fb2-bc9b-43de-a4b7-baa4723d2249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.120.22.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-27T16:36:11.031Z",
      "x_nadsec_last_seen": "2026-05-29T14:49:14.247Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "198953"
      ],
      "x_nadsec_orgs": [
        "Proton66 OOO"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "s********s"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--8b8f73c4-70be-4c11-ae8f-6918e62a3833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.52.241.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-28T08:29:48.655Z",
      "x_nadsec_last_seen": "2026-05-28T09:38:06.561Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b37c5b5b-8b40-450e-8600-d36530600284",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.224.12.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-05-28T08:14:22.892Z",
      "x_nadsec_last_seen": "2026-05-28T11:26:42.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--40535e7d-8a1e-42a2-b0c8-6f15526fb895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.8.75.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T08:06:28.473Z",
      "x_nadsec_last_seen": "2026-05-28T08:08:36.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-05-28T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--15294ca4-e8be-4123-8add-c99c234d942e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.56.181.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:05:10.000Z",
      "valid_until": "2026-06-29T09:05:09.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-05-28T08:49:53.044Z",
      "x_nadsec_last_seen": "2026-05-28T08:53:33.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=US; asn=11351; asn_org=Charter Communications Inc",
      "id": "indicator--4ed40e15-d1d9-402c-814c-f4a51ba5c26e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '108.176.102.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-28T09:12:28.671Z",
      "x_nadsec_last_seen": "2026-05-28T09:12:30.092Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11351"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--2340e2d2-d21c-4c33-9cbb-1a1c1d93b086",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.30.192.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-28T10:02:11.960Z",
      "x_nadsec_last_seen": "2026-05-28T10:02:12.159Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--e01efea0-3ae8-49d3-9dbc-eb7eee46e294",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.236.115.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T09:25:27.211Z",
      "x_nadsec_last_seen": "2026-05-28T09:27:32.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=15704; asn_org=Xtra Telecom S.A.",
      "id": "indicator--c5b095df-c478-4781-95e9-b13b361c7f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.253.56.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T10:00:53.394Z",
      "x_nadsec_last_seen": "2026-05-28T10:02:59.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "15704"
      ],
      "x_nadsec_orgs": [
        "Xtra Telecom S.A."
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--4cfa0d95-35c1-4254-bbe6-73f40f911ea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.112.34.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T09:20:38.434Z",
      "x_nadsec_last_seen": "2026-05-28T09:22:44.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--8b769d3b-3133-4a2e-87a7-4d818a2ffd42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.38.101.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T09:47:40.146Z",
      "x_nadsec_last_seen": "2026-05-28T09:49:47.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=268516; asn_org=Midia Net Telecom",
      "id": "indicator--1cf2894f-6bd1-4ab4-8c1c-e92449618ec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.162.106.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T09:43:59.111Z",
      "x_nadsec_last_seen": "2026-05-28T09:44:03.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268516"
      ],
      "x_nadsec_orgs": [
        "Midia Net Telecom"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=137697; asn_org=CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China.; user(top)=**",
      "id": "indicator--cc3eb471-9b42-46e1-bf76-153465ba6b57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.220.41.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T09:51:36.607Z",
      "x_nadsec_last_seen": "2026-05-28T09:51:36.607Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "137697"
      ],
      "x_nadsec_orgs": [
        "CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cdcbe21e-3aab-408b-a6bf-5105c6ea4707",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.62.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T09:16:11.069Z",
      "x_nadsec_last_seen": "2026-05-28T09:16:11.069Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-28T10:05:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--600a0a3d-bfd2-46e2-ac3f-caf70f723279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T10:05:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.106.15.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T10:05:33.000Z",
      "valid_until": "2026-06-29T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T09:49:28.311Z",
      "x_nadsec_last_seen": "2026-05-28T09:51:35.265Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-28T11:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--fd49f28b-544f-4220-b741-8c92a9837f14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.123.146.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:05:59.000Z",
      "valid_until": "2026-06-29T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T10:32:31.931Z",
      "x_nadsec_last_seen": "2026-05-28T10:34:37.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-28T11:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=262595; asn_org=OnNet Telecomunicacoes LTDA",
      "id": "indicator--542aae69-2ef7-42ab-8758-07eb21cea70b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.0.66.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:05:59.000Z",
      "valid_until": "2026-06-29T11:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T10:57:45.544Z",
      "x_nadsec_last_seen": "2026-05-28T10:57:45.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262595"
      ],
      "x_nadsec_orgs": [
        "OnNet Telecomunicacoes LTDA"
      ]
    },
    {
      "created": "2026-05-28T11:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--ec664993-85ac-4b7f-920d-31a99b4aebba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.177.13.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:05:59.000Z",
      "valid_until": "2026-06-29T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T10:21:08.094Z",
      "x_nadsec_last_seen": "2026-05-28T10:23:12.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-05-28T11:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--045dad7c-abb4-4e62-aa28-c7578bea0638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.194.110.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:05:59.000Z",
      "valid_until": "2026-06-29T11:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-28T11:00:54.015Z",
      "x_nadsec_last_seen": "2026-05-29T08:22:32.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-05-28T11:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--bc514496-42cb-42da-8957-55bf22104a53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.78.23.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:05:59.000Z",
      "valid_until": "2026-06-29T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T11:03:32.301Z",
      "x_nadsec_last_seen": "2026-05-28T11:03:32.301Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T11:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IR; asn=43754; asn_org=Asiatech Data Transmission company",
      "id": "indicator--73511351-a704-43a5-a545-0667cf55ad69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.156.12.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:05:59.000Z",
      "valid_until": "2026-06-29T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T10:37:13.221Z",
      "x_nadsec_last_seen": "2026-05-28T10:37:13.221Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "43754"
      ],
      "x_nadsec_orgs": [
        "Asiatech Data Transmission company"
      ]
    },
    {
      "created": "2026-05-28T11:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--0cf98ca6-1034-4863-879f-2b2af4953529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T11:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.95.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:05:59.000Z",
      "valid_until": "2026-06-29T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T10:05:31.320Z",
      "x_nadsec_last_seen": "2026-05-28T10:05:54.898Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-28T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--1d18c60a-6ed9-4486-9e12-0104d09e72a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.9.35.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:05:05.000Z",
      "valid_until": "2026-06-29T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T11:53:08.409Z",
      "x_nadsec_last_seen": "2026-05-28T11:55:13.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-05-28T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--1ef59579-d552-483e-82d2-baca5b1f4fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.218.179.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:05:05.000Z",
      "valid_until": "2026-06-29T12:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T11:55:00.796Z",
      "x_nadsec_last_seen": "2026-05-28T11:57:06.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-28T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1d02f3f6-076b-42fe-86bb-1cff4c5b832e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.2.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:05:05.000Z",
      "valid_until": "2026-06-29T12:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T11:53:18.429Z",
      "x_nadsec_last_seen": "2026-05-28T11:53:28.573Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5c508141-e30f-4838-ab94-f6726cf67076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.106.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:05:05.000Z",
      "valid_until": "2026-06-29T12:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T11:54:37.165Z",
      "x_nadsec_last_seen": "2026-05-28T11:54:37.165Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--3083f9d4-da1b-4882-be28-f3bfdb8d1347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.52.137.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:05:05.000Z",
      "valid_until": "2026-06-29T12:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T08:52:58.917Z",
      "x_nadsec_last_seen": "2026-05-28T11:25:40.350Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24739; asn_org=JSC Severen-Telecom",
      "id": "indicator--dc631b20-cd1e-4f39-81bf-338db4421ae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.23.112.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:05:05.000Z",
      "valid_until": "2026-06-29T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T11:26:01.168Z",
      "x_nadsec_last_seen": "2026-05-28T11:28:07.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24739"
      ],
      "x_nadsec_orgs": [
        "JSC Severen-Telecom"
      ]
    },
    {
      "created": "2026-05-28T12:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--73f5d47b-ed2f-4341-8e9b-9d75dc11f139",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T12:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.29.126.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T12:05:05.000Z",
      "valid_until": "2026-06-29T12:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T11:58:07.691Z",
      "x_nadsec_last_seen": "2026-05-28T12:00:14.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-05-28T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6ef9d153-18c9-448b-8602-531498e445f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.198.141.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:05:10.000Z",
      "valid_until": "2026-06-29T13:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T12:54:51.493Z",
      "x_nadsec_last_seen": "2026-05-28T12:54:51.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--7d3f1a7a-58a9-4673-acee-04d06bed09ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.78.185.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:05:10.000Z",
      "valid_until": "2026-06-29T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T12:05:10.316Z",
      "x_nadsec_last_seen": "2026-05-28T12:07:15.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-05-28T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=ftpd; ports=21; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--35c03d8e-255b-4316-bba9-6a9fcc93f14d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:05:10.000Z",
      "valid_until": "2026-06-29T13:05:08.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-05-28T12:55:11.776Z",
      "x_nadsec_last_seen": "2026-05-28T15:51:20.224Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "42",
        "445",
        "81",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mirrorc",
        "mirrord",
        "smbd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-28T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--d577b099-401b-440f-bbc8-cdc3ce426d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.202.7.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:05:10.000Z",
      "valid_until": "2026-06-29T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T12:09:37.007Z",
      "x_nadsec_last_seen": "2026-05-28T12:11:42.678Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-28T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=39351; asn_org=31173 Services AB",
      "id": "indicator--118b2e7b-4a36-41a6-b1d4-8a836371c5e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.32.126.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:05:10.000Z",
      "valid_until": "2026-06-29T13:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T12:59:59.680Z",
      "x_nadsec_last_seen": "2026-05-28T12:59:59.680Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "39351"
      ],
      "x_nadsec_orgs": [
        "31173 Services AB"
      ]
    },
    {
      "created": "2026-05-28T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=28126; asn_org=BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "id": "indicator--09ade1bf-df82-43d3-b173-74a973e28f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.42.35.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:05:10.000Z",
      "valid_until": "2026-06-29T13:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T13:01:05.644Z",
      "x_nadsec_last_seen": "2026-05-28T13:08:16.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28126"
      ],
      "x_nadsec_orgs": [
        "BRISANET SERVICOS DE TELECOMUNICACOES S.A"
      ]
    },
    {
      "created": "2026-05-28T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=44941; asn_org=ZAO Astrakhan Digital Television",
      "id": "indicator--105b11da-e165-4008-968a-241ae5d3718a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.142.14.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T13:05:10.000Z",
      "valid_until": "2026-06-29T13:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T12:23:15.301Z",
      "x_nadsec_last_seen": "2026-05-28T12:25:21.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44941"
      ],
      "x_nadsec_orgs": [
        "ZAO Astrakhan Digital Television"
      ]
    },
    {
      "created": "2026-05-28T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--eb3c0e2a-8ea0-4f82-87c8-def5eddd6fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.211.146.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:05:05.000Z",
      "valid_until": "2026-06-29T14:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T13:43:24.468Z",
      "x_nadsec_last_seen": "2026-05-28T13:50:07.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-05-28T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6960e07c-4d87-4d59-8fea-c7a733a2adbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.231.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:05:05.000Z",
      "valid_until": "2026-06-29T14:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T13:31:17.646Z",
      "x_nadsec_last_seen": "2026-05-28T13:31:20.814Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-28T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=52838; asn_org=WN TELECOM LTDA - ME",
      "id": "indicator--2e73308b-4711-4551-94a3-71abef6a6a20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.66.101.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:05:05.000Z",
      "valid_until": "2026-06-29T14:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T13:28:14.168Z",
      "x_nadsec_last_seen": "2026-05-28T13:35:24.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52838"
      ],
      "x_nadsec_orgs": [
        "WN TELECOM LTDA - ME"
      ]
    },
    {
      "created": "2026-05-28T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262307; asn_org=Amplas Net Provedor de Internet Ltda",
      "id": "indicator--22d96690-81f8-417a-9e4a-0ebddc3214dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.87.198.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:05:05.000Z",
      "valid_until": "2026-06-29T14:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T13:19:14.840Z",
      "x_nadsec_last_seen": "2026-05-28T13:19:21.482Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262307"
      ],
      "x_nadsec_orgs": [
        "Amplas Net Provedor de Internet Ltda"
      ]
    },
    {
      "created": "2026-05-28T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--8cbd1adc-9a35-4f97-bc9b-ca1940ff1d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.153.82.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:05:05.000Z",
      "valid_until": "2026-06-29T14:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T13:16:38.359Z",
      "x_nadsec_last_seen": "2026-05-28T13:18:48.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-05-28T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:05:05.000Z",
      "valid_until": "2026-06-29T14:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T13:50:57.992Z",
      "x_nadsec_last_seen": "2026-05-28T13:50:57.992Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-28T14:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--bd16a9ab-5c0b-45ae-af5d-e78ba792b6f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T14:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.109.51.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:05:05.000Z",
      "valid_until": "2026-06-29T14:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T14:01:07.858Z",
      "x_nadsec_last_seen": "2026-05-28T14:03:14.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-28T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--0df07722-77b3-4683-9a59-e1ad7e70bfa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.23.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:05:05.000Z",
      "valid_until": "2026-06-29T15:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T14:52:20.422Z",
      "x_nadsec_last_seen": "2026-05-28T14:54:27.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-28T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--6e5ce91b-430b-43f0-a414-42bf794bb8fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.15.60.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:05:05.000Z",
      "valid_until": "2026-06-29T15:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-17T22:41:43.059Z",
      "x_nadsec_last_seen": "2026-05-28T14:46:39.425Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-28T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ada5160d-a91f-4a2d-9621-1aa9fcde905b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.117.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:05:05.000Z",
      "valid_until": "2026-06-29T15:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T14:08:25.653Z",
      "x_nadsec_last_seen": "2026-05-28T14:08:25.653Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-28T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--6a440cad-00e7-4050-8e57-dd7bbc76aa54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.129.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:05:05.000Z",
      "valid_until": "2026-06-29T15:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T14:24:31.084Z",
      "x_nadsec_last_seen": "2026-05-28T14:26:37.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-28T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--31d64b42-ef29-41ec-b672-b2e7e5a48232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.88.167.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:05:05.000Z",
      "valid_until": "2026-06-29T15:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T14:59:38.052Z",
      "x_nadsec_last_seen": "2026-05-28T14:59:38.577Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-28T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f9bebd10-14a4-427d-b26c-ee9198497d82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.199.80.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:05:05.000Z",
      "valid_until": "2026-06-29T15:05:03.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-28T14:05:32.924Z",
      "x_nadsec_last_seen": "2026-05-28T14:08:22.168Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-28T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JM; asn=33576; asn_org=Digicel Jamaica; user(top)=**",
      "id": "indicator--63df61dc-5639-43f2-9ded-55015c5d6f81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '63.143.99.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:05:05.000Z",
      "valid_until": "2026-06-29T15:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T14:11:26.896Z",
      "x_nadsec_last_seen": "2026-05-28T14:11:26.896Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JM"
      ],
      "x_nadsec_asns": [
        "33576"
      ],
      "x_nadsec_orgs": [
        "Digicel Jamaica"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T16:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--be3194c0-75be-43d6-abfd-a9e038bfe51f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.242.251.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:05:59.000Z",
      "valid_until": "2026-06-29T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T15:24:12.302Z",
      "x_nadsec_last_seen": "2026-05-28T15:31:32.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-28T16:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--13e677ad-6dc9-40c1-91b0-f75573421e8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.118.145.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:05:59.000Z",
      "valid_until": "2026-06-29T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T15:26:23.046Z",
      "x_nadsec_last_seen": "2026-05-28T15:31:08.212Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T16:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PT; asn=3243; asn_org=Servicos De Comunicacoes E Multimedia S.A.",
      "id": "indicator--5065f73d-23df-442e-af63-f300218b59e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.65.181.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:05:59.000Z",
      "valid_until": "2026-06-29T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T15:30:59.822Z",
      "x_nadsec_last_seen": "2026-05-28T15:33:05.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "3243"
      ],
      "x_nadsec_orgs": [
        "Servicos De Comunicacoes E Multimedia S.A."
      ]
    },
    {
      "created": "2026-05-28T16:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--63e4f8de-02a2-46bd-8b86-532d700e5345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.88.94.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:05:59.000Z",
      "valid_until": "2026-06-29T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T15:27:16.156Z",
      "x_nadsec_last_seen": "2026-05-28T15:27:16.484Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-28T16:05:59.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--ba8a6912-8855-4780-b1f2-cc5f6e42a391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T16:05:59.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.15.137.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T16:05:59.000Z",
      "valid_until": "2026-06-29T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T15:27:00.960Z",
      "x_nadsec_last_seen": "2026-05-28T15:31:51.564Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--dc4f0f43-3664-4bcb-b902-2d1f0e2fde69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.211.96.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T17:59:13.502Z",
      "x_nadsec_last_seen": "2026-05-28T18:01:28.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57333; asn_org=KaspiyTelekom Ltd.",
      "id": "indicator--6c06069c-6e91-429a-b6da-e092cfe59ee2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.97.172.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T17:19:19.252Z",
      "x_nadsec_last_seen": "2026-05-28T17:21:25.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57333"
      ],
      "x_nadsec_orgs": [
        "KaspiyTelekom Ltd."
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--d9d86535-69c9-43a4-94df-5ce5c13de6be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.117.137.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T17:02:30.575Z",
      "x_nadsec_last_seen": "2026-05-28T17:10:06.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--4d2f8d10-e01b-4539-9b88-5adfd46a758d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.6.65.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T17:21:22.480Z",
      "x_nadsec_last_seen": "2026-05-28T17:21:22.480Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--2e82ef3a-bff6-470d-b292-444cc152725a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.67.135.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-28T17:53:27.413Z",
      "x_nadsec_last_seen": "2026-05-28T17:56:29.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3f9bb0f1-69af-47ee-9736-6f39161e4fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T17:52:36.976Z",
      "x_nadsec_last_seen": "2026-05-28T17:52:36.976Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1617166b-e86f-4197-9904-4d2a12450fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.221.60.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T17:30:06.254Z",
      "x_nadsec_last_seen": "2026-05-28T17:30:06.254Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--1fdcc66e-5960-4d38-bc3c-e7b10f669299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T18:02:33.601Z",
      "x_nadsec_last_seen": "2026-05-28T18:02:33.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398101; asn_org=GoDaddy.com, LLC",
      "id": "indicator--7f74ad54-e514-4f95-bd6b-95b41db61474",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.167.39.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:05:05.000Z",
      "valid_until": "2026-06-29T18:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T17:42:04.077Z",
      "x_nadsec_last_seen": "2026-05-30T09:55:44.808Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398101"
      ],
      "x_nadsec_orgs": [
        "GoDaddy.com, LLC"
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--2652c88e-78f1-48fd-b2ad-05d9163d329f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.71.122.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T18:26:16.459Z",
      "x_nadsec_last_seen": "2026-05-28T18:26:23.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--cbe805f7-ea0c-4463-a228-f83167343725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.156.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T18:46:20.038Z",
      "x_nadsec_last_seen": "2026-05-28T18:46:39.104Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2fd0247b-02be-42d5-bd8a-8fd2c15f73f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T18:06:24.333Z",
      "x_nadsec_last_seen": "2026-05-28T18:06:50.448Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=265430; asn_org=JDA Net - SKYNET Teleinformatica",
      "id": "indicator--0763fe42-007b-49f1-9797-6a351cfc84a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.195.88.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T18:35:21.794Z",
      "x_nadsec_last_seen": "2026-05-28T18:35:28.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265430"
      ],
      "x_nadsec_orgs": [
        "JDA Net - SKYNET Teleinformatica"
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--d833e2a4-e5a3-4bd3-bf70-615581fd3cea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-28T18:25:42.377Z",
      "x_nadsec_last_seen": "2026-05-28T19:07:17.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--c43cc9ae-bf0b-476b-adb6-c785fac0d52b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T18:21:07.069Z",
      "x_nadsec_last_seen": "2026-05-28T18:23:18.762Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a56bbb1d-72f2-4335-a84a-b9b52a9b093b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T18:37:21.087Z",
      "x_nadsec_last_seen": "2026-05-28T18:37:21.087Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--4a43ad6b-4b69-470e-b75d-e9d50feee377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.95.205.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T18:12:09.350Z",
      "x_nadsec_last_seen": "2026-05-28T18:12:14.517Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--4b6732fc-6159-4602-a2a2-5db0c5bbe69e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-28T18:58:41.796Z",
      "x_nadsec_last_seen": "2026-05-28T18:59:31.793Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-05-28T19:07:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T19:07:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:07:54.000Z",
      "valid_until": "2026-06-29T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-10T17:40:40.072Z",
      "x_nadsec_last_seen": "2026-05-28T18:56:02.086Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-28T20:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e0af87fd-f315-4e84-bdee-9e2f993bfb2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.33.148.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:05:38.000Z",
      "valid_until": "2026-06-29T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T19:32:50.160Z",
      "x_nadsec_last_seen": "2026-05-28T19:34:55.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-28T20:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--c84337bb-c048-4c76-a263-78d3d128b053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.221.195.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:05:38.000Z",
      "valid_until": "2026-06-29T20:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T19:21:41.170Z",
      "x_nadsec_last_seen": "2026-05-28T19:21:41.170Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T20:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--d17bf593-57e9-4786-b2cf-f29fd7b660c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.137.220.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:05:38.000Z",
      "valid_until": "2026-06-29T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T19:45:42.631Z",
      "x_nadsec_last_seen": "2026-05-28T19:49:18.465Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T20:05:38.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T20:05:38.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.106.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:05:38.000Z",
      "valid_until": "2026-06-29T20:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T19:38:29.113Z",
      "x_nadsec_last_seen": "2026-05-28T19:38:29.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2f04636d-b3a5-4511-aaa5-6f305d587080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-28T21:38:11.795Z",
      "x_nadsec_last_seen": "2026-05-28T21:38:22.145Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--7e981756-3b7a-467a-9cc0-75e77892a2e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.219.30.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T21:19:11.927Z",
      "x_nadsec_last_seen": "2026-05-28T21:20:22.685Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3151; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--208d418e-95d0-49e3-a61a-698d12364706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.92.119.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-05-28T21:16:52.776Z",
      "x_nadsec_last_seen": "2026-05-28T21:58:33.980Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CR; asn=11830; asn_org=Instituto Costarricense de Electricidad y Telecom.",
      "id": "indicator--e3aebbe5-e7ac-4b74-bc05-23d1568ab917",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.237.239.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-28T20:48:45.711Z",
      "x_nadsec_last_seen": "2026-05-31T19:39:41.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CR"
      ],
      "x_nadsec_asns": [
        "11830"
      ],
      "x_nadsec_orgs": [
        "Instituto Costarricense de Electricidad y Telecom."
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T21:15:07.253Z",
      "x_nadsec_last_seen": "2026-05-28T21:15:07.253Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=56047; asn_org=China Mobile communications corporation; user(top)=**",
      "id": "indicator--e44c1b21-749a-4f0a-b47a-39bf168495dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.143.37.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-17T22:48:13.208Z",
      "x_nadsec_last_seen": "2026-05-28T21:37:16.803Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56047"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--57d6ac12-8332-4c60-8b20-73fa509c7685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.254.111.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T21:19:17.506Z",
      "x_nadsec_last_seen": "2026-05-28T21:21:22.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--83cbacdb-4a64-4bdc-82d5-07cf7eeab0a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.146.112.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T21:45:41.910Z",
      "x_nadsec_last_seen": "2026-05-28T21:47:48.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--55827aef-e450-4380-8dbc-3d7998867719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.83.27.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T21:22:00.597Z",
      "x_nadsec_last_seen": "2026-05-28T21:24:05.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1336d06f-0ca1-4ed3-bb4c-2baa4e09635d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.84.6.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T21:15:12.540Z",
      "x_nadsec_last_seen": "2026-05-28T21:17:17.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-28T22:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--add26371-178d-4f79-9275-617082baaa37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T22:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T22:05:11.000Z",
      "valid_until": "2026-06-29T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-22T01:30:44.661Z",
      "x_nadsec_last_seen": "2026-05-28T21:33:28.385Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SZ; asn=329095; asn_org=AFRIMETRO-AS",
      "id": "indicator--2ad41849-097d-47d2-a96b-bd12349481ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.215.99.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T22:12:35.798Z",
      "x_nadsec_last_seen": "2026-05-28T22:14:41.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SZ"
      ],
      "x_nadsec_asns": [
        "329095"
      ],
      "x_nadsec_orgs": [
        "AFRIMETRO-AS"
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=401696; asn_org=cognetcloud INC",
      "id": "indicator--f9811cfe-dc38-49f4-834e-fe84894b956f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.73.162.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T22:46:52.845Z",
      "x_nadsec_last_seen": "2026-05-28T22:49:00.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "401696"
      ],
      "x_nadsec_orgs": [
        "cognetcloud INC"
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fc5e5c81-5d10-4755-b57a-6cdefd500fb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T22:06:07.030Z",
      "x_nadsec_last_seen": "2026-05-28T22:06:07.030Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=137697; asn_org=CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China.; user(top)=**",
      "id": "indicator--0543b475-388d-452f-8173-c6403e39bb3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.97.183.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T22:24:05.115Z",
      "x_nadsec_last_seen": "2026-05-28T22:24:05.115Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "137697"
      ],
      "x_nadsec_orgs": [
        "CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--6f99147f-bb18-43dd-b873-9b3c733871ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.0.128.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-28T22:29:03.310Z",
      "x_nadsec_last_seen": "2026-05-28T22:36:33.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--06599d2f-34fa-48dc-9a4b-fa1ddc9b9b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T22:24:21.694Z",
      "x_nadsec_last_seen": "2026-05-28T22:24:21.694Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=CN; asn=4847; asn_org=China Networks Inter-Exchange; user(top)=**",
      "id": "indicator--5196be21-fa53-420d-9d02-2f7501aeed07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.245.1.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-28T22:51:21.619Z",
      "x_nadsec_last_seen": "2026-05-28T22:51:22.043Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4847"
      ],
      "x_nadsec_orgs": [
        "China Networks Inter-Exchange"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--1ec71da1-c084-46d4-a946-ab8373e8179f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.119.24.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T22:51:53.675Z",
      "x_nadsec_last_seen": "2026-05-28T22:53:59.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-28T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--312aba89-e6ab-4966-93f4-47b92720b10b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-28T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.48.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:05:10.000Z",
      "valid_until": "2026-06-29T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T22:52:58.318Z",
      "x_nadsec_last_seen": "2026-05-28T22:52:58.318Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--da587325-269f-4116-8f7b-75281b560267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T00:01:28.294Z",
      "x_nadsec_last_seen": "2026-05-31T18:35:47.997Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CL; asn=16629; asn_org=CTC. CORP S.A. TELEFONICA EMPRESAS",
      "id": "indicator--9049874c-0ae7-44b3-a9a2-3506abbd22fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.54.223.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T00:01:49.337Z",
      "x_nadsec_last_seen": "2026-05-29T00:03:56.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "16629"
      ],
      "x_nadsec_orgs": [
        "CTC. CORP S.A. TELEFONICA EMPRESAS"
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--c35e1159-ffc9-4f6b-a57e-8806ff6f914e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.198.103.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T23:54:43.131Z",
      "x_nadsec_last_seen": "2026-05-28T23:56:47.522Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=40021; asn_org=Contabo Inc.; user(top)=**",
      "id": "indicator--a17edf49-95dd-4ae5-b068-315b427ad8db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.216.81.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T23:41:49.767Z",
      "x_nadsec_last_seen": "2026-05-28T23:41:49.767Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "40021"
      ],
      "x_nadsec_orgs": [
        "Contabo Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=59508; asn_org=Krasnoyarsk network Ltd.",
      "id": "indicator--fa4e4c8d-3e02-43e1-9347-c0990b37ab03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.159.111.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T00:03:30.591Z",
      "x_nadsec_last_seen": "2026-05-29T00:03:30.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "59508"
      ],
      "x_nadsec_orgs": [
        "Krasnoyarsk network Ltd."
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T23:32:55.279Z",
      "x_nadsec_last_seen": "2026-05-28T23:32:55.279Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7572820d-c87d-4fe6-9159-d929fffa8c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T23:53:03.479Z",
      "x_nadsec_last_seen": "2026-05-28T23:53:03.479Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-29T00:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--6530685f-1855-4454-993e-116b1459f4b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T00:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.219.2.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:05:11.000Z",
      "valid_until": "2026-06-30T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-28T23:20:47.138Z",
      "x_nadsec_last_seen": "2026-05-28T23:20:47.138Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--a99aeb64-3732-4961-a49d-edc6cd2a4415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.14.18.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T00:53:14.309Z",
      "x_nadsec_last_seen": "2026-05-29T00:55:19.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1bd14718-1af4-4293-a628-5ecc6f2293ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.190.91.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T00:12:15.809Z",
      "x_nadsec_last_seen": "2026-05-29T00:14:21.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1659c9e2-9344-44cc-885e-dc39dfff5824",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.199.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T00:40:42.285Z",
      "x_nadsec_last_seen": "2026-05-29T03:02:43.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--da4c5267-27a0-412e-87fc-edf02ee9b52c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-29T00:40:29.058Z",
      "x_nadsec_last_seen": "2026-05-31T08:32:31.862Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--594e472f-c30a-404f-a38f-329ec40c17c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.176.160.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T00:30:23.850Z",
      "x_nadsec_last_seen": "2026-05-29T00:30:23.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--17fe5ca8-9c6d-41f0-a251-ea3d9c25a982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T00:12:48.186Z",
      "x_nadsec_last_seen": "2026-05-29T00:12:48.186Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--1baa88b4-47e9-4313-ae47-0e0d589328a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.114.21.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T01:01:08.630Z",
      "x_nadsec_last_seen": "2026-05-29T01:03:15.053Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-29T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0167e5a7-2a98-4ae4-b863-8d1c1d8f4bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.109.47.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:05:03.000Z",
      "valid_until": "2026-06-30T01:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T01:04:05.984Z",
      "x_nadsec_last_seen": "2026-05-29T01:06:12.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--7e7402d4-86c8-43fa-81c9-431ec020db21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.165.222.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:05:10.000Z",
      "valid_until": "2026-06-30T02:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-29T01:27:48.884Z",
      "x_nadsec_last_seen": "2026-05-29T16:01:26.420Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-29T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--90b84d7b-3d15-4462-959d-10d25c77f0a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.164.244.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:05:10.000Z",
      "valid_until": "2026-06-30T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T01:44:05.546Z",
      "x_nadsec_last_seen": "2026-05-29T01:46:10.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a767c2b9-0c0f-4d3e-94fd-90ebba7e55f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:05:10.000Z",
      "valid_until": "2026-06-30T02:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T01:27:03.688Z",
      "x_nadsec_last_seen": "2026-05-29T01:27:04.202Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-29T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d4ff81e0-0d21-4899-932c-9372504705ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.236.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:05:10.000Z",
      "valid_until": "2026-06-30T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T01:07:35.318Z",
      "x_nadsec_last_seen": "2026-05-29T14:55:04.402Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3f4b40a4-aa79-4e10-9bfe-16228a1bbb42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.246.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:05:10.000Z",
      "valid_until": "2026-06-30T02:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T01:07:23.433Z",
      "x_nadsec_last_seen": "2026-05-29T01:07:34.697Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--4f52d406-c657-4a83-9619-a0ef6853b51e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.1.209.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:05:10.000Z",
      "valid_until": "2026-06-30T02:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T01:20:56.477Z",
      "x_nadsec_last_seen": "2026-05-29T01:23:04.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-29T02:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--d7eec1bc-74ff-4c25-8022-cf2b5dbc0d80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T02:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.148.201.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:05:10.000Z",
      "valid_until": "2026-06-30T02:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-29T02:04:23.649Z",
      "x_nadsec_last_seen": "2026-05-29T02:11:56.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b5c68010-699b-4a3e-8aa5-95158ffd13b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.167.223.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:05:03.000Z",
      "valid_until": "2026-06-30T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T02:15:22.261Z",
      "x_nadsec_last_seen": "2026-05-29T02:21:47.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--0540166e-0220-4d28-bcbd-c4696b8d9936",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.6.205.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:05:03.000Z",
      "valid_until": "2026-06-30T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T02:27:20.923Z",
      "x_nadsec_last_seen": "2026-05-29T02:29:25.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--c5b50114-ba52-414e-b6b3-5ac6348f0bf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.248.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:05:03.000Z",
      "valid_until": "2026-06-30T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T02:33:39.547Z",
      "x_nadsec_last_seen": "2026-05-29T02:35:46.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--10042647-85ba-481b-8b15-aa26e3a33891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.99.189.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:05:03.000Z",
      "valid_until": "2026-06-30T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T02:19:26.851Z",
      "x_nadsec_last_seen": "2026-05-29T19:05:04.771Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--ed427ab5-5b05-4855-9950-95e8c32fa80e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.144.117.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:05:03.000Z",
      "valid_until": "2026-06-30T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T02:09:54.908Z",
      "x_nadsec_last_seen": "2026-05-29T02:13:57.058Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--863926b0-833b-460a-aabb-4dc8067ecd2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.100.90.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:05:03.000Z",
      "valid_until": "2026-06-30T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T03:00:45.320Z",
      "x_nadsec_last_seen": "2026-05-30T18:46:27.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "58224"
      ],
      "x_nadsec_orgs": [
        "Iran Telecommunication Company PJS"
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fe60707b-d69e-4ef8-8053-971fd68cb8f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.24.153.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T03:46:40.728Z",
      "x_nadsec_last_seen": "2026-05-29T03:48:45.566Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b4a05d0b-813b-4960-8e75-b41687de2405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.205.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T03:19:05.466Z",
      "x_nadsec_last_seen": "2026-05-29T03:19:05.466Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T03:06:10.684Z",
      "x_nadsec_last_seen": "2026-05-29T03:06:10.684Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--eaaefae8-82b8-4a16-8a70-61b4a5e8e34d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.217.216.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-29T03:21:39.829Z",
      "x_nadsec_last_seen": "2026-05-29T03:30:16.394Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--9ec9a745-ac3b-4714-8a8e-f7e0387fc063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.14.13.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-29T03:06:07.779Z",
      "x_nadsec_last_seen": "2026-05-29T03:11:04.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T03:51:06.867Z",
      "x_nadsec_last_seen": "2026-05-29T03:51:06.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ed4b75a0-9133-4b17-9f17-5f01d529d5f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T03:51:06.447Z",
      "x_nadsec_last_seen": "2026-05-31T21:09:08.950Z",
      "x_nadsec_ports": [
        "42",
        "445",
        "39151"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-29T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8e50dff4-0c71-4e01-ae12-c865e118aab7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.120.243.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:05:10.000Z",
      "valid_until": "2026-06-30T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T03:11:29.756Z",
      "x_nadsec_last_seen": "2026-05-29T03:16:59.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--0d986215-eff8-4efc-9d14-6ef2277cd551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.41.225.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:05:11.000Z",
      "valid_until": "2026-06-30T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T04:22:59.323Z",
      "x_nadsec_last_seen": "2026-05-29T04:22:59.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-29T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47165; asn_org=Omskie kabelnye seti Ltd.",
      "id": "indicator--1ee3bbfd-bc27-43f4-b385-ce6e208d5ea0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.62.84.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:05:11.000Z",
      "valid_until": "2026-06-30T05:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-18T14:49:46.003Z",
      "x_nadsec_last_seen": "2026-05-29T04:50:10.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47165"
      ],
      "x_nadsec_orgs": [
        "Omskie kabelnye seti Ltd."
      ]
    },
    {
      "created": "2026-05-29T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53139; asn_org=RDF Informatica Ltda",
      "id": "indicator--3b571ea9-f388-4069-940c-9a418bb7bd4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.109.84.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:05:11.000Z",
      "valid_until": "2026-06-30T05:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T04:34:16.601Z",
      "x_nadsec_last_seen": "2026-05-29T04:36:23.217Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53139"
      ],
      "x_nadsec_orgs": [
        "RDF Informatica Ltda"
      ]
    },
    {
      "created": "2026-05-29T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KE; asn=15808; asn_org=ACCESSKENYA-KE ACCESSKENYA GROUP LTD is an ISP serving",
      "id": "indicator--7deb5de3-35d7-4da4-8fdf-226e1e58faac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.215.80.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:05:11.000Z",
      "valid_until": "2026-06-30T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T04:19:19.122Z",
      "x_nadsec_last_seen": "2026-05-29T04:19:19.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "15808"
      ],
      "x_nadsec_orgs": [
        "ACCESSKENYA-KE ACCESSKENYA GROUP LTD is an ISP serving"
      ]
    },
    {
      "created": "2026-05-29T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ee689902-5743-49c5-a7c5-07476c0ac280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.55.39.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:05:11.000Z",
      "valid_until": "2026-06-30T05:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T04:50:42.260Z",
      "x_nadsec_last_seen": "2026-05-29T04:50:44.259Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NO; asn=2116; asn_org=Globalconnect As",
      "id": "indicator--b0fc6c31-a137-408a-af95-d0e360ae781b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.90.13.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:05:11.000Z",
      "valid_until": "2026-06-30T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T05:45:09.386Z",
      "x_nadsec_last_seen": "2026-05-29T05:52:18.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "2116"
      ],
      "x_nadsec_orgs": [
        "Globalconnect As"
      ]
    },
    {
      "created": "2026-05-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--11d5f4d9-d356-42a6-b9b7-357b7117a1b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:05:11.000Z",
      "valid_until": "2026-06-30T06:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T06:01:00.426Z",
      "x_nadsec_last_seen": "2026-05-29T06:01:00.778Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cfcd06c8-f037-4506-a7ad-62c955a6c2c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:05:11.000Z",
      "valid_until": "2026-06-30T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T05:28:02.532Z",
      "x_nadsec_last_seen": "2026-05-29T05:28:02.532Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-29T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--ca9e956f-bb57-472d-b5d3-229f6fc78f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.201.175.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:05:11.000Z",
      "valid_until": "2026-06-30T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T05:26:30.558Z",
      "x_nadsec_last_seen": "2026-05-29T05:26:30.558Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=141137; asn_org=PT Media Cepat Indonesia",
      "id": "indicator--825293ee-d7c6-4367-8633-92dae6f7c75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.158.253.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T06:49:02.655Z",
      "x_nadsec_last_seen": "2026-05-29T06:56:01.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "141137"
      ],
      "x_nadsec_orgs": [
        "PT Media Cepat Indonesia"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=37069; asn_org=MOBINIL",
      "id": "indicator--f4dd1899-99af-44de-8867-889c66141fcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.192.129.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T06:15:10.239Z",
      "x_nadsec_last_seen": "2026-05-29T06:17:17.302Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "37069"
      ],
      "x_nadsec_orgs": [
        "MOBINIL"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c3bd6849-38f6-49a7-bca7-099edbfd57b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.140.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T06:34:31.685Z",
      "x_nadsec_last_seen": "2026-05-29T06:36:36.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d34393b0-351a-4138-938a-b6de0924d055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.252.30.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T07:02:17.940Z",
      "x_nadsec_last_seen": "2026-05-30T10:39:20.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--ae9a5c60-87d8-4afc-8abb-020e2583184b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.149.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T06:32:31.488Z",
      "x_nadsec_last_seen": "2026-05-29T06:33:00.198Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a2c1b226-16d3-487a-acf2-0841deef70b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.62.242.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T06:32:28.619Z",
      "x_nadsec_last_seen": "2026-05-29T06:32:28.619Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--eba98da1-bdec-4a7c-bb43-f4b73ab21ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.103.103.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T06:57:05.922Z",
      "x_nadsec_last_seen": "2026-05-29T06:59:12.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--e90c61e4-0eb8-4d6c-b426-6361dd1dcc71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.46.15.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T06:59:56.080Z",
      "x_nadsec_last_seen": "2026-05-29T07:06:51.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--6c32972a-0587-41e3-8409-b266a98f79fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.47.35.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T06:51:32.510Z",
      "x_nadsec_last_seen": "2026-05-29T06:53:39.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-05-29T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--9d76fcab-3e37-4ab6-8061-38099b542c7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.9.215.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:05:10.000Z",
      "valid_until": "2026-06-30T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T06:46:19.518Z",
      "x_nadsec_last_seen": "2026-05-29T06:48:26.158Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--272a9cbb-c031-45ff-8c6e-a35d46c41c63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.163.123.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T08:04:44.286Z",
      "x_nadsec_last_seen": "2026-05-29T08:06:49.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=134878; asn_org=GLORIOSA INFOTEL IT SERVICES INDIA PRIVATE LIMITED",
      "id": "indicator--f283abd6-d1ee-4c3d-a462-115a614f69a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.204.156.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T07:37:12.882Z",
      "x_nadsec_last_seen": "2026-05-29T07:41:32.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134878"
      ],
      "x_nadsec_orgs": [
        "GLORIOSA INFOTEL IT SERVICES INDIA PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--c9895777-8947-46d3-82fc-7ab2a7340345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.175.249.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T07:58:40.997Z",
      "x_nadsec_last_seen": "2026-05-29T08:05:08.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--cb2fd99c-1a87-4885-8ad4-d28962f485eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.82.98.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-29T07:55:03.962Z",
      "x_nadsec_last_seen": "2026-05-29T08:12:01.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--69d1bc23-9437-45bc-bc3f-f40574f735e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.101.233.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T08:01:09.508Z",
      "x_nadsec_last_seen": "2026-05-29T08:08:43.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--c66c39ed-4d95-4433-abd6-7380beae8743",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.188.41.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T07:15:24.815Z",
      "x_nadsec_last_seen": "2026-05-29T07:15:30.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e49e3261-669b-47f7-9105-79a1af0c45f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.163.204.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T07:12:49.473Z",
      "x_nadsec_last_seen": "2026-05-29T07:21:03.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BW; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--04a2af52-5952-4c43-ac5b-28be72de0564",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.60.156.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T08:00:37.510Z",
      "x_nadsec_last_seen": "2026-05-29T08:02:45.574Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BW"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--b781d1fd-cfd1-4e65-b970-4a7954199626",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.116.242.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T07:34:35.620Z",
      "x_nadsec_last_seen": "2026-05-29T07:41:31.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-29T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b9696fc4-c07e-4e5f-b360-500c8ea1a331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.64.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:05:10.000Z",
      "valid_until": "2026-06-30T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T07:35:04.276Z",
      "x_nadsec_last_seen": "2026-05-29T07:35:04.276Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5883033e-d60c-46d5-9cdb-2b68e3169d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.173.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T08:36:59.191Z",
      "x_nadsec_last_seen": "2026-05-29T08:36:59.191Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8e836d81-9f23-436f-9967-a734409c71b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.4.139.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T08:36:58.948Z",
      "x_nadsec_last_seen": "2026-05-29T08:39:04.638Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fae9e4f6-0111-4124-8cb8-b8acf705cf93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.170.101.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-05-29T08:18:48.970Z",
      "x_nadsec_last_seen": "2026-05-29T08:22:09.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2ed54da8-333d-4e8b-9c6f-e37387b1685f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.224.144.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T09:04:49.101Z",
      "x_nadsec_last_seen": "2026-05-29T09:06:53.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bed0dbff-1ad2-47b0-956b-a9e169ca6e2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.244.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T08:20:11.374Z",
      "x_nadsec_last_seen": "2026-05-29T08:20:11.374Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=13188; asn_org=Content Delivery Network Ltd",
      "id": "indicator--a81536f3-f4d2-44fa-b0d3-b26916c10162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.224.181.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T08:07:06.553Z",
      "x_nadsec_last_seen": "2026-05-29T08:14:24.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "13188"
      ],
      "x_nadsec_orgs": [
        "Content Delivery Network Ltd"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c770c341-09a7-4017-9a9b-9444e40c971d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T08:54:29.215Z",
      "x_nadsec_last_seen": "2026-05-29T08:54:39.390Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=271218; asn_org=AL TELECOM - TELECOMUNICACOES LTDA",
      "id": "indicator--782f6e1d-6472-48d2-8c02-6f0d8eb35ed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.10.136.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T08:32:13.436Z",
      "x_nadsec_last_seen": "2026-05-29T08:32:13.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271218"
      ],
      "x_nadsec_orgs": [
        "AL TELECOM - TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3111; services=smbd; ports=445; cc=IN; asn=45769; asn_org=D-Vois Broadband Pvt Ltd",
      "id": "indicator--e6d261ce-995e-471f-834c-d6770f73822d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.48.200.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 3155,
      "x_nadsec_first_seen": "2026-05-28T20:33:38.823Z",
      "x_nadsec_last_seen": "2026-05-29T08:31:23.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45769"
      ],
      "x_nadsec_orgs": [
        "D-Vois Broadband Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--9c9fd80c-2193-4ebf-bd19-37726961653b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.108.74.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T08:10:11.634Z",
      "x_nadsec_last_seen": "2026-05-29T08:12:18.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8ac2642c-ed00-408c-9fd8-e4b55db4e8e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.81.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T08:31:55.361Z",
      "x_nadsec_last_seen": "2026-05-29T08:31:55.652Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f4d33a00-8374-4fcf-8c4c-325893638ee0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '207.154.245.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T08:20:39.436Z",
      "x_nadsec_last_seen": "2026-05-29T08:20:39.436Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NO; asn=2116; asn_org=Globalconnect As",
      "id": "indicator--4dcb41df-372a-4da2-bbb2-b2e5de35ab20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.118.45.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T08:47:38.198Z",
      "x_nadsec_last_seen": "2026-05-29T08:54:43.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "2116"
      ],
      "x_nadsec_orgs": [
        "Globalconnect As"
      ]
    },
    {
      "created": "2026-05-29T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fde3b67d-3e3b-4e6c-83b8-2f6e94467b79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.229.5.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:05:10.000Z",
      "valid_until": "2026-06-30T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T08:05:08.565Z",
      "x_nadsec_last_seen": "2026-05-29T08:07:13.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-29T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=VN; asn=151858; asn_org=INTERDIGI JOINT STOCK COMPANY",
      "id": "indicator--8898f308-0e42-4014-b23e-8232e7500c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.195.238.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:05:02.000Z",
      "valid_until": "2026-06-30T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T09:45:19.173Z",
      "x_nadsec_last_seen": "2026-05-29T09:45:19.173Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "151858"
      ],
      "x_nadsec_orgs": [
        "INTERDIGI JOINT STOCK COMPANY"
      ]
    },
    {
      "created": "2026-05-29T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f329ad28-4ac6-4e42-8b63-22e493ec8f67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.249.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:05:02.000Z",
      "valid_until": "2026-06-30T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T09:26:24.490Z",
      "x_nadsec_last_seen": "2026-05-29T09:26:24.490Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CH; asn=39351; asn_org=31173 Services AB",
      "id": "indicator--8e4feadd-5746-450e-8196-2805270da414",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.32.127.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:05:02.000Z",
      "valid_until": "2026-06-30T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T09:28:22.641Z",
      "x_nadsec_last_seen": "2026-05-29T09:28:22.641Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "39351"
      ],
      "x_nadsec_orgs": [
        "31173 Services AB"
      ]
    },
    {
      "created": "2026-05-29T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--601be7e1-bf50-4f0d-92d8-d1fa2cab8d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.195.35.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:05:02.000Z",
      "valid_until": "2026-06-30T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T09:52:06.931Z",
      "x_nadsec_last_seen": "2026-05-29T09:54:13.503Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-05-29T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--c82c5654-6a28-426b-a9cf-5c24e5b02a5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.99.137.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:05:02.000Z",
      "valid_until": "2026-06-30T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T09:40:08.858Z",
      "x_nadsec_last_seen": "2026-05-29T09:51:56.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-29T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--254cd2b8-6af8-4ef1-8e3e-561e26f4f9f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.29.126.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:05:02.000Z",
      "valid_until": "2026-06-30T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T09:39:21.175Z",
      "x_nadsec_last_seen": "2026-05-29T09:45:10.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--99ce82bd-c73f-4e9a-9e42-191c16539d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.26.154.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T11:04:57.016Z",
      "x_nadsec_last_seen": "2026-05-29T11:11:31.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--d2abd04c-543c-4ed5-b83d-adc1609d36db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.26.55.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T10:33:46.614Z",
      "x_nadsec_last_seen": "2026-05-29T10:35:51.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--bfdc22bf-036f-4c09-8771-593f199e3460",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.207.171.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T11:00:39.748Z",
      "x_nadsec_last_seen": "2026-05-29T11:07:44.350Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--4bf26d22-3b1f-477f-8d05-a619d481f580",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.81.194.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T10:41:58.299Z",
      "x_nadsec_last_seen": "2026-05-29T10:44:05.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=18747; asn_org=IFX Corporation",
      "id": "indicator--b240b20a-8546-45af-a47d-05bf7e8bf2be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.91.226.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T10:58:51.607Z",
      "x_nadsec_last_seen": "2026-05-29T10:58:51.607Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "18747"
      ],
      "x_nadsec_orgs": [
        "IFX Corporation"
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=19429; asn_org=Colombia; user(top)=**",
      "id": "indicator--64340a7a-0884-42be-bc9f-7eed0f89a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.244.23.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T11:02:09.107Z",
      "x_nadsec_last_seen": "2026-05-29T11:02:09.107Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a3b70532-379a-4781-8166-0dcc7e5cd67b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.158.254.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T10:13:03.589Z",
      "x_nadsec_last_seen": "2026-05-29T10:15:10.445Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T11:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0c7b3a6f-5fdf-46ee-9398-0ccf597ea785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T11:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.142.41.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:05:11.000Z",
      "valid_until": "2026-06-30T11:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T10:42:59.456Z",
      "x_nadsec_last_seen": "2026-05-29T10:45:22.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--73fac53a-1212-4af8-bcf5-95bc9b6ccefc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.224.13.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:05:11.000Z",
      "valid_until": "2026-06-30T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T11:57:53.479Z",
      "x_nadsec_last_seen": "2026-05-29T12:00:01.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-29T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mirrorc; ports=32835; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.29.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:05:11.000Z",
      "valid_until": "2026-06-30T12:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-29T11:15:21.897Z",
      "x_nadsec_last_seen": "2026-05-29T11:18:25.454Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017",
        "32835"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=46606; asn_org=Unified Layer",
      "id": "indicator--9c73c5a3-ccaf-4367-8d60-f6ece46d8aee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.214.99.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:05:11.000Z",
      "valid_until": "2026-06-30T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T11:16:56.253Z",
      "x_nadsec_last_seen": "2026-05-29T11:16:56.253Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "46606"
      ],
      "x_nadsec_orgs": [
        "Unified Layer"
      ]
    },
    {
      "created": "2026-05-29T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=27831; asn_org=Colombia Movil",
      "id": "indicator--97c43194-6ad8-479d-b298-e53b77174b65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.253.145.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:05:11.000Z",
      "valid_until": "2026-06-30T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T11:06:50.604Z",
      "x_nadsec_last_seen": "2026-05-29T11:08:55.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27831"
      ],
      "x_nadsec_orgs": [
        "Colombia Movil"
      ]
    },
    {
      "created": "2026-05-29T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--ea94ce26-ba89-44bd-9af7-61e0af87fe02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.6.65.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:05:11.000Z",
      "valid_until": "2026-06-30T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T11:41:11.012Z",
      "x_nadsec_last_seen": "2026-05-29T11:43:17.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--71a151c5-c5b7-4ff2-84e6-5698d005e0aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '115.79.6.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T12:58:29.723Z",
      "x_nadsec_last_seen": "2026-05-29T13:00:35.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--1c1f3321-9697-4fb6-a937-0efc585bb82f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.187.126.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T12:24:55.352Z",
      "x_nadsec_last_seen": "2026-05-29T12:31:33.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4ad3c694-4ada-4383-8783-81afe67d1a7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.60.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T12:07:55.414Z",
      "x_nadsec_last_seen": "2026-05-29T12:08:06.716Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--f6f65fbb-1ad3-401a-a7e9-5c59c30d3fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.239.64.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T12:17:54.273Z",
      "x_nadsec_last_seen": "2026-05-30T08:32:36.230Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--a74d1041-98ed-47b7-b307-f4b2f5738f52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.77.187.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T12:27:20.808Z",
      "x_nadsec_last_seen": "2026-05-29T12:29:26.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--2ec6e4ff-8783-4f02-a9ed-1d7c1cbeeae9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.137.157.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T12:51:08.510Z",
      "x_nadsec_last_seen": "2026-05-29T12:56:09.597Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--6ff46c6b-d836-4525-b3fd-f69b47a58f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.137.171.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T12:37:34.372Z",
      "x_nadsec_last_seen": "2026-05-29T12:43:30.140Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MU; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--52693bc8-252b-4fbb-bc1c-b1533c520db3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.191.224.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T12:53:54.163Z",
      "x_nadsec_last_seen": "2026-05-29T12:56:01.997Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MU"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-29T12:41:11.570Z",
      "x_nadsec_last_seen": "2026-05-29T12:41:47.340Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-05-29T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--588705a4-11db-4903-95f7-b239aaa6d307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:05:10.000Z",
      "valid_until": "2026-06-30T13:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T12:34:37.384Z",
      "x_nadsec_last_seen": "2026-05-30T22:36:17.651Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--f4e3bdc3-220a-4f84-9d59-3ef19cde3980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.89.22.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T13:07:12.434Z",
      "x_nadsec_last_seen": "2026-05-29T13:09:19.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--510d0106-f938-4379-9003-6ff1f45135af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.116.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T13:44:31.280Z",
      "x_nadsec_last_seen": "2026-05-29T13:44:31.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--385ea253-81c3-4fd5-883f-f6bd988f055b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '106.226.57.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T13:34:05.857Z",
      "x_nadsec_last_seen": "2026-05-29T13:34:32.597Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3f6334af-c7f0-4508-bd4a-bdf5006eb634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.21.211.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T13:53:02.298Z",
      "x_nadsec_last_seen": "2026-05-29T13:55:07.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4c8aa060-577f-4be3-a677-e92db0a920ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.255.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T13:13:39.860Z",
      "x_nadsec_last_seen": "2026-05-29T13:13:58.691Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=265204; asn_org=LINKFIRE TELECOM LTDA",
      "id": "indicator--e13dc876-bb6f-41ec-9c0e-0756db9bae8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.250.66.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T13:32:59.810Z",
      "x_nadsec_last_seen": "2026-05-29T13:35:12.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265204"
      ],
      "x_nadsec_orgs": [
        "LINKFIRE TELECOM LTDA"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=273244; asn_org=EXPERTOS EN TECNOLOGIA Y TELECOMUNICACIONES S.A.S",
      "id": "indicator--9a4fe4cb-dc1d-41a5-aad2-ddc7623352ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.63.190.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T13:32:48.101Z",
      "x_nadsec_last_seen": "2026-05-29T13:32:48.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "273244"
      ],
      "x_nadsec_orgs": [
        "EXPERTOS EN TECNOLOGIA Y TELECOMUNICACIONES S.A.S"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=6147; asn_org=INTEGRATEL PERU S.A.A.; user(top)=**",
      "id": "indicator--b20160a4-9b16-4bda-b1c1-3fd77abad7d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.239.208.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T13:08:14.444Z",
      "x_nadsec_last_seen": "2026-05-29T13:08:14.444Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "6147"
      ],
      "x_nadsec_orgs": [
        "INTEGRATEL PERU S.A.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d9a7748d-8f34-4c69-a927-37f91eefa3fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.56.215.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T13:59:31.877Z",
      "x_nadsec_last_seen": "2026-05-29T14:01:39.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a665c507-8a6a-413f-b636-dd194fc5665f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.218.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-05-29T13:07:08.969Z",
      "x_nadsec_last_seen": "2026-05-29T13:07:11.957Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--10afebf2-e76c-47ae-b3fe-689bc99c9c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.99.126.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T13:42:34.781Z",
      "x_nadsec_last_seen": "2026-05-29T13:44:41.417Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-29T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--a880e09a-e8bf-4c8e-b5a5-e1319dcad3cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.249.52.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:05:10.000Z",
      "valid_until": "2026-06-30T14:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-29T13:20:19.977Z",
      "x_nadsec_last_seen": "2026-05-29T13:55:46.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5ee5aa00-22d7-431a-a0a6-2a6b3a236fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.179.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T14:40:31.350Z",
      "x_nadsec_last_seen": "2026-05-29T14:40:55.336Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e397d4ac-aeb7-43fe-ac11-d514eeecff1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.219.164.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T14:14:33.437Z",
      "x_nadsec_last_seen": "2026-05-29T14:17:12.066Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--f41a26d8-d8bf-4e92-9d9b-0c6d29a2a45a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.79.102.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T14:31:40.337Z",
      "x_nadsec_last_seen": "2026-05-29T14:33:45.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37148; asn_org=globacom-as",
      "id": "indicator--0f0a3de5-9ad6-4b02-8111-fc8c47bdb9b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.203.65.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T14:56:07.189Z",
      "x_nadsec_last_seen": "2026-05-29T15:03:18.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37148"
      ],
      "x_nadsec_orgs": [
        "globacom-as"
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T14:20:48.362Z",
      "x_nadsec_last_seen": "2026-05-29T14:20:48.362Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3aa65c15-40c9-45db-86b3-35265bc9e921",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.120.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T14:55:01.878Z",
      "x_nadsec_last_seen": "2026-05-29T14:55:01.878Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--4c211673-4566-4ba3-bd53-3cffd509a6a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T14:10:44.745Z",
      "x_nadsec_last_seen": "2026-05-29T14:10:44.745Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-29T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--2561c50a-b85a-4c45-8dd9-c9f22b473d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.29.124.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:05:10.000Z",
      "valid_until": "2026-06-30T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T14:52:51.200Z",
      "x_nadsec_last_seen": "2026-05-29T14:54:57.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-05-29T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--afb4502d-a0fd-45f5-95c3-4f161e626476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.66.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:05:02.000Z",
      "valid_until": "2026-06-30T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T15:32:17.901Z",
      "x_nadsec_last_seen": "2026-05-29T15:32:17.901Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-29T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=42610; asn_org=Rostelecom",
      "id": "indicator--6a9476ed-057e-4982-b151-95befe24d9b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.32.8.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:05:02.000Z",
      "valid_until": "2026-06-30T16:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T15:34:28.244Z",
      "x_nadsec_last_seen": "2026-05-29T15:36:34.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42610"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--0831935c-d15c-4e3f-8566-2340932be47d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.175.55.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:05:02.000Z",
      "valid_until": "2026-06-30T16:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T15:50:06.205Z",
      "x_nadsec_last_seen": "2026-05-29T15:52:11.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-05-29T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--6622ee20-0189-47fc-a293-cb46ffad7235",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.79.151.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:05:02.000Z",
      "valid_until": "2026-06-30T16:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T15:26:08.138Z",
      "x_nadsec_last_seen": "2026-05-30T11:41:12.617Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=136357; asn_org=Siddiqui Global Services Pvt. Ltd.",
      "id": "indicator--077f15df-635b-42d1-b703-48f601e65f7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.93.203.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T16:38:46.561Z",
      "x_nadsec_last_seen": "2026-05-29T16:45:13.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136357"
      ],
      "x_nadsec_orgs": [
        "Siddiqui Global Services Pvt. Ltd."
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--835ae69f-a3dc-4482-b1fd-b9e2b6f6d4c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.251.181.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T16:23:07.856Z",
      "x_nadsec_last_seen": "2026-05-31T18:50:47.828Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--3f395b80-5e84-43d1-b58a-9c4b9295dbf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.255.62.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-29T16:16:44.457Z",
      "x_nadsec_last_seen": "2026-05-29T16:35:36.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=XK; asn=206262; asn_org=TelKos L.L.C; user(top)=**",
      "id": "indicator--8c3ce282-57c7-4dc3-b31b-df562f585d9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.78.161.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T16:33:18.004Z",
      "x_nadsec_last_seen": "2026-05-29T16:33:19.238Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "206262"
      ],
      "x_nadsec_orgs": [
        "TelKos L.L.C"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--abe62bc8-45fd-4986-91e6-c1ac959d6e9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T16:13:41.257Z",
      "x_nadsec_last_seen": "2026-05-29T16:19:30.557Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--66aca7fa-2830-4031-832a-c1daa226952f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.119.126.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T16:52:13.535Z",
      "x_nadsec_last_seen": "2026-05-29T16:54:27.224Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--0805655a-ff3e-4e27-8a64-e729d80dac8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.219.133.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T16:33:10.402Z",
      "x_nadsec_last_seen": "2026-05-29T16:33:10.402Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.; user(top)=**",
      "id": "indicator--3f3ae5e2-26de-42cb-ae68-0129c994078d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.13.190.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T16:13:10.530Z",
      "x_nadsec_last_seen": "2026-05-29T16:13:10.530Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.",
      "id": "indicator--0947e14f-a5d4-49b3-a749-1794dfb436c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.203.86.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T16:57:22.566Z",
      "x_nadsec_last_seen": "2026-05-29T16:59:27.732Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--26d27fd5-11a4-430d-86ce-550068de3f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T16:51:48.041Z",
      "x_nadsec_last_seen": "2026-05-29T16:51:58.201Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7b8a29ad-a669-4061-ac3d-8c4b822c391a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T16:57:30.515Z",
      "x_nadsec_last_seen": "2026-05-29T16:57:30.515Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d2f04745-d14f-4d84-a772-fec359fc3e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.203.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T16:13:17.493Z",
      "x_nadsec_last_seen": "2026-05-29T16:20:27.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--b62d0df7-525d-4d39-abab-6745c0db0b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.99.251.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T16:19:30.270Z",
      "x_nadsec_last_seen": "2026-05-29T16:27:11.133Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IR; asn=44244; asn_org=Iran Cell Service and Communication Company",
      "id": "indicator--7d99a705-30d6-4246-a3a4-3ac2b7c303e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.126.241.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T16:14:18.964Z",
      "x_nadsec_last_seen": "2026-05-29T16:14:22.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "44244"
      ],
      "x_nadsec_orgs": [
        "Iran Cell Service and Communication Company"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7032cf5d-cc5b-467c-8f03-10d79ef60dc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.247.27.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T16:20:34.065Z",
      "x_nadsec_last_seen": "2026-05-29T16:22:41.167Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-29T17:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--2a3d6c32-fdc5-49f8-acb6-49ec0471e6e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T17:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.187.112.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:05:05.000Z",
      "valid_until": "2026-06-30T17:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T16:55:18.927Z",
      "x_nadsec_last_seen": "2026-05-29T16:57:25.443Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-29T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--2eb842c3-f0ac-4c06-b680-cd9e08527609",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.100.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:05:10.000Z",
      "valid_until": "2026-06-30T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T17:34:11.246Z",
      "x_nadsec_last_seen": "2026-05-29T17:36:24.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-29T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--d28ef92b-cad0-40cc-b0f7-f29eacb61b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.118.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:05:10.000Z",
      "valid_until": "2026-06-30T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T17:43:50.431Z",
      "x_nadsec_last_seen": "2026-05-29T17:45:57.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-29T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LB; asn=56902; asn_org=Energy Bridge Sarl",
      "id": "indicator--ab855821-da84-4bc7-9226-7a5d4d557e45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.187.131.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:05:10.000Z",
      "valid_until": "2026-06-30T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T17:27:51.263Z",
      "x_nadsec_last_seen": "2026-05-29T17:29:57.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LB"
      ],
      "x_nadsec_asns": [
        "56902"
      ],
      "x_nadsec_orgs": [
        "Energy Bridge Sarl"
      ]
    },
    {
      "created": "2026-05-29T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--d6582bef-8ded-40c2-b71c-0cbc767face8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.105.24.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:05:10.000Z",
      "valid_until": "2026-06-30T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T17:31:17.636Z",
      "x_nadsec_last_seen": "2026-05-29T17:31:18.981Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-29T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ebb0ab2b-3e05-46a3-a5b2-3c28626c1c31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:05:10.000Z",
      "valid_until": "2026-06-30T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T17:14:07.691Z",
      "x_nadsec_last_seen": "2026-05-30T17:26:51.992Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GA; asn=36924; asn_org=GVA-Canalbox",
      "id": "indicator--87d4435b-7358-49f0-a7c4-7c9cf1d77b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.142.30.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T18:29:32.206Z",
      "x_nadsec_last_seen": "2026-05-29T18:31:45.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GA"
      ],
      "x_nadsec_asns": [
        "36924"
      ],
      "x_nadsec_orgs": [
        "GVA-Canalbox"
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--17ade691-139a-49a1-8f33-0a2d51810b55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.90.82.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T18:56:03.182Z",
      "x_nadsec_last_seen": "2026-05-29T18:58:10.613Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--7cd54d5f-aa31-40ca-b41b-7555eca4ac1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.53.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-29T18:50:15.472Z",
      "x_nadsec_last_seen": "2026-05-29T18:59:10.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--47afa391-69b0-4ab5-8a9e-edce53ccc442",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.137.2.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T19:00:23.445Z",
      "x_nadsec_last_seen": "2026-05-29T19:00:23.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.",
      "id": "indicator--f6bca900-c3a9-4364-84fb-61e1e6c27b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.189.57.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-29T18:47:22.026Z",
      "x_nadsec_last_seen": "2026-05-29T19:30:46.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "17072"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T18:23:29.985Z",
      "x_nadsec_last_seen": "2026-05-29T18:29:06.068Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--492ebad4-fac9-4f90-af30-1bf163b13a2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.127.202.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T18:22:14.855Z",
      "x_nadsec_last_seen": "2026-05-29T18:22:25.046Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=22773; asn_org=Cox Communications Inc.",
      "id": "indicator--615b56c7-6975-4059-9888-31277f294b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.234.157.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T18:31:49.894Z",
      "x_nadsec_last_seen": "2026-05-29T18:31:49.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22773"
      ],
      "x_nadsec_orgs": [
        "Cox Communications Inc."
      ]
    },
    {
      "created": "2026-05-29T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e9c98d1d-a54d-47e2-9bf3-03a5af8057d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.234.43.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T19:05:06.000Z",
      "valid_until": "2026-06-30T19:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T18:25:41.748Z",
      "x_nadsec_last_seen": "2026-05-29T18:27:48.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-29T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=37236; asn_org=Reflex-Solutions",
      "id": "indicator--8bc8f36f-bf1b-48f9-ac5c-403bf808ba05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.119.243.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:05:11.000Z",
      "valid_until": "2026-06-30T20:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T20:01:01.574Z",
      "x_nadsec_last_seen": "2026-05-29T20:02:10.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37236"
      ],
      "x_nadsec_orgs": [
        "Reflex-Solutions"
      ]
    },
    {
      "created": "2026-05-29T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--e035a1bf-60fb-4e15-9ecd-ce1a51ffdc6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.86.88.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:05:11.000Z",
      "valid_until": "2026-06-30T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T19:19:07.767Z",
      "x_nadsec_last_seen": "2026-05-29T19:19:33.975Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-05-29T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AZ; asn=28787; asn_org=Aztelekom LLC",
      "id": "indicator--bf587661-569b-42e9-b965-63e3ed873d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.154.0.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:05:11.000Z",
      "valid_until": "2026-06-30T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T20:03:07.809Z",
      "x_nadsec_last_seen": "2026-05-29T20:05:15.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "28787"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-05-29T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=7545; asn_org=TPG Telecom Limited",
      "id": "indicator--02f317d4-e515-45fb-9410-e726642f4415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.240.252.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:05:11.000Z",
      "valid_until": "2026-06-30T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T19:36:27.365Z",
      "x_nadsec_last_seen": "2026-05-29T19:38:30.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "7545"
      ],
      "x_nadsec_orgs": [
        "TPG Telecom Limited"
      ]
    },
    {
      "created": "2026-05-29T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=UZ; asn=8193; asn_org=Uzbektelekom Joint Stock Company; user(top)=r**t; pass(top)=1**4",
      "id": "indicator--3f811afb-84f7-4f8b-b844-e684760d3669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.54.73.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:05:11.000Z",
      "valid_until": "2026-06-30T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T19:44:09.889Z",
      "x_nadsec_last_seen": "2026-05-29T19:44:09.889Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "8193"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4"
      ]
    },
    {
      "created": "2026-05-29T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--6bedc05e-828d-4980-8489-8506fe9df1b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.186.113.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:05:10.000Z",
      "valid_until": "2026-06-30T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T20:06:15.178Z",
      "x_nadsec_last_seen": "2026-05-29T20:22:37.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-05-29T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--0ef08495-d36e-4ea1-82ae-8df5ec8a06c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.25.168.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:05:10.000Z",
      "valid_until": "2026-06-30T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T20:18:38.366Z",
      "x_nadsec_last_seen": "2026-05-29T20:18:38.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-29T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--e8ca4c08-2590-467f-9a81-dcab5f564fe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:05:10.000Z",
      "valid_until": "2026-06-30T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T20:47:50.131Z",
      "x_nadsec_last_seen": "2026-05-29T20:47:50.131Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-29T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b4a575ee-b702-47fc-92c7-4c1ee2f9a092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T21:05:10.000Z",
      "valid_until": "2026-06-30T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-29T20:31:26.967Z",
      "x_nadsec_last_seen": "2026-05-29T20:31:28.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-29T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--7f710d24-6f2b-49ab-83f3-470b28a0ad8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.20.91.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:05:05.000Z",
      "valid_until": "2026-06-30T22:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-29T22:00:36.720Z",
      "x_nadsec_last_seen": "2026-05-29T22:15:26.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-29T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:05:05.000Z",
      "valid_until": "2026-06-30T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T21:06:03.330Z",
      "x_nadsec_last_seen": "2026-05-29T21:06:03.330Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-29T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28580; asn_org=Cilnet Comunicacao e Informatica S.A.",
      "id": "indicator--4dd84991-ef34-48cf-82c4-ddaad8fc81fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.84.8.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:05:05.000Z",
      "valid_until": "2026-06-30T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T21:18:28.061Z",
      "x_nadsec_last_seen": "2026-05-29T21:20:34.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28580"
      ],
      "x_nadsec_orgs": [
        "Cilnet Comunicacao e Informatica S.A."
      ]
    },
    {
      "created": "2026-05-29T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f61e4fc4-f0c2-4ac8-8225-c19b255750d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:05:05.000Z",
      "valid_until": "2026-06-30T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T22:00:31.806Z",
      "x_nadsec_last_seen": "2026-05-29T22:00:31.806Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-29T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--2c491c39-7d51-43bc-86a7-15a8dfc1f277",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.6.109.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:05:05.000Z",
      "valid_until": "2026-06-30T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T21:57:41.984Z",
      "x_nadsec_last_seen": "2026-05-29T21:59:48.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-29T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31163; asn_org=PJSC MegaFon",
      "id": "indicator--d29aa56e-a6b7-4ea6-aa8e-c80879eabcc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-29T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.120.104.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:05:05.000Z",
      "valid_until": "2026-06-30T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T21:41:42.203Z",
      "x_nadsec_last_seen": "2026-05-29T21:43:48.577Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31163"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--eeacc2df-9a27-432d-a995-32a09643eede",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.93.125.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-29T22:44:38.042Z",
      "x_nadsec_last_seen": "2026-05-29T23:30:59.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--09890e8f-94fc-42c2-ba15-756366864caf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-29T23:26:34.150Z",
      "x_nadsec_last_seen": "2026-05-29T23:26:34.150Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--2b31a778-f083-4a3a-bd76-e1c5591a44fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.57.180.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T23:42:00.088Z",
      "x_nadsec_last_seen": "2026-05-29T23:44:08.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--56eb68f2-1c50-4a00-b4aa-4e545e3c42e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.0.57.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T23:42:42.084Z",
      "x_nadsec_last_seen": "2026-05-29T23:44:49.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--2ea25969-7ab8-407b-8027-11cc588b8e81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.181.101.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-29T23:24:36.495Z",
      "x_nadsec_last_seen": "2026-05-29T23:26:43.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=267251; asn_org=TELEFONARNET TELECOMUNICACOES",
      "id": "indicator--f6e78952-7c29-4b2a-a343-61bee771b76b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.232.75.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T00:00:20.022Z",
      "x_nadsec_last_seen": "2026-05-30T00:05:45.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267251"
      ],
      "x_nadsec_orgs": [
        "TELEFONARNET TELECOMUNICACOES"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=266579; asn_org=Oni Servico de Comunicacao e Multimidia Ltda",
      "id": "indicator--88e9e735-f546-4acd-967c-6225f4ccc7ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.7.9.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-29T22:15:43.189Z",
      "x_nadsec_last_seen": "2026-05-29T23:41:57.042Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266579"
      ],
      "x_nadsec_orgs": [
        "Oni Servico de Comunicacao e Multimidia Ltda"
      ]
    },
    {
      "created": "2026-05-30T00:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f715b369-b5a2-4af2-8190-739a301fb94f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T00:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.251.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:05:10.000Z",
      "valid_until": "2026-07-01T00:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-29T23:09:38.014Z",
      "x_nadsec_last_seen": "2026-05-29T23:10:01.584Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c95a1b2b-e47e-477c-889e-c84538f08039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.199.154.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T00:39:55.208Z",
      "x_nadsec_last_seen": "2026-05-30T00:39:55.208Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--298c9895-4d5a-420f-9731-dcee96b62c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T00:59:11.378Z",
      "x_nadsec_last_seen": "2026-05-30T00:59:12.185Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.144.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T00:32:31.125Z",
      "x_nadsec_last_seen": "2026-05-30T00:32:31.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--bb85506e-9fb1-4177-9cb3-0d50828dcd0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.47.113.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T00:17:41.733Z",
      "x_nadsec_last_seen": "2026-05-30T00:19:51.539Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--dbf0bd23-d0c5-4779-9f65-edec24e8849f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.9.205.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T00:10:15.374Z",
      "x_nadsec_last_seen": "2026-05-30T00:14:56.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--669d04be-d62d-43da-ad07-baff49cbb8fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.39.210.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T00:37:35.357Z",
      "x_nadsec_last_seen": "2026-05-30T00:37:35.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=5033; asn_org=Key Information Systems, Inc.; user(top)=**",
      "id": "indicator--7ffe5435-1bab-447e-af7d-f3c48c3aad8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '207.178.215.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T00:56:51.266Z",
      "x_nadsec_last_seen": "2026-05-30T00:56:51.266Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5033"
      ],
      "x_nadsec_orgs": [
        "Key Information Systems, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**; pass(top)=5****4",
      "id": "indicator--1d47e343-43e4-47f2-8f19-1a500de4cb91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.90.155.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T00:39:51.442Z",
      "x_nadsec_last_seen": "2026-05-30T00:44:58.279Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "5****4"
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--661b0504-962e-4614-bbe9-6a620c30658d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.247.10.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-30T00:34:14.766Z",
      "x_nadsec_last_seen": "2026-05-30T00:34:27.510Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--72f5f799-77c8-43d3-ae96-4fb1494a07d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-30T00:24:17.024Z",
      "x_nadsec_last_seen": "2026-05-30T00:25:52.223Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--c8f217ae-b265-42c4-b9a6-f6d8f081a934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T00:24:37.508Z",
      "x_nadsec_last_seen": "2026-05-30T00:25:41.697Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--1777a83b-5ec0-4ef7-a154-66bb8f070ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T00:25:06.969Z",
      "x_nadsec_last_seen": "2026-05-30T00:25:06.969Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--e1df11e4-4d0b-4d3a-88aa-c20a18e30f48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T00:24:58.554Z",
      "x_nadsec_last_seen": "2026-05-30T00:24:58.554Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-05-30T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6864b9ee-54e4-448b-b19f-bb3fa17dc7f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.235.100.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:05:10.000Z",
      "valid_until": "2026-07-01T01:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T00:16:30.385Z",
      "x_nadsec_last_seen": "2026-05-30T00:16:30.385Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SN; asn=37649; asn_org=Tigo",
      "id": "indicator--e9ed4cfe-d6c3-41e8-8d31-097469683af2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.164.131.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T01:47:53.697Z",
      "x_nadsec_last_seen": "2026-05-30T01:50:01.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SN"
      ],
      "x_nadsec_asns": [
        "37649"
      ],
      "x_nadsec_orgs": [
        "Tigo"
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--d134c7a1-038f-4685-98c0-9652858b9362",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.165.127.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T01:50:00.704Z",
      "x_nadsec_last_seen": "2026-05-30T01:54:06.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8ee35330-7dd2-4b65-8b82-8ff316513e30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.61.193.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T01:26:11.079Z",
      "x_nadsec_last_seen": "2026-05-30T01:28:17.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--baa5b08b-1efb-4e7c-bc79-09a1e074b675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.161.161.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T01:22:30.733Z",
      "x_nadsec_last_seen": "2026-05-30T01:22:56.279Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--ce014f29-7eb6-48d4-be30-d1b6a71422cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '122.154.149.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T01:49:20.099Z",
      "x_nadsec_last_seen": "2026-05-30T01:51:24.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--b6544b95-1b64-4bae-a61a-ec387938bb31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.219.47.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-30T01:55:40.390Z",
      "x_nadsec_last_seen": "2026-05-30T02:04:35.304Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--2ca3f3e8-87eb-44ce-9a20-ecc0ba0d28d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.10.24.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T01:11:37.597Z",
      "x_nadsec_last_seen": "2026-05-30T01:13:44.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-05-30T02:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--8c4cb910-9a56-4f6d-a25b-0c8cfeed0f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T02:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.53.175.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:05:09.000Z",
      "valid_until": "2026-07-01T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T01:20:24.953Z",
      "x_nadsec_last_seen": "2026-05-30T01:20:24.953Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--393995cd-0951-4657-a8e4-f22cbbf7ae05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T02:13:52.455Z",
      "x_nadsec_last_seen": "2026-05-30T02:13:52.455Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--4d2016fe-f2d1-4b91-9491-747f235ce864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T02:13:52.845Z",
      "x_nadsec_last_seen": "2026-05-30T02:13:52.845Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4811; asn_org=China Telecom Group",
      "id": "indicator--b9e04b96-4e42-4cbf-8180-be4babe5e4e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.46.230.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T02:51:55.640Z",
      "x_nadsec_last_seen": "2026-05-30T02:51:56.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4811"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=pptpd; ports=1723; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.230.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-30T02:06:03.264Z",
      "x_nadsec_last_seen": "2026-05-30T02:09:34.128Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "33387"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--386d514b-1d8a-4a52-8cbd-ccb40c11922a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.220.124.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-30T02:56:38.467Z",
      "x_nadsec_last_seen": "2026-05-30T03:00:42.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--a23bee22-5752-4a22-ab4d-8f5307dee533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.2.104.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T02:16:09.775Z",
      "x_nadsec_last_seen": "2026-05-30T02:18:16.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--9da85368-bb82-4707-a82e-f81b9ea13d3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.105.110.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T02:06:37.825Z",
      "x_nadsec_last_seen": "2026-05-30T02:06:37.825Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--4ea7c29a-01c8-4758-ace6-b10a975e29d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.139.138.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T02:23:51.337Z",
      "x_nadsec_last_seen": "2026-05-30T02:23:51.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=24863; asn_org=LINKdotNET; user(top)=**",
      "id": "indicator--12fd6bbf-1ea1-465c-92e7-160fc0917f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.240.88.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T02:16:51.554Z",
      "x_nadsec_last_seen": "2026-05-30T02:16:51.554Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=209630; asn_org=LLC Vash Kredit Bank",
      "id": "indicator--adad80b2-225a-4976-b017-1e0b9b54f893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.92.42.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:05:11.000Z",
      "valid_until": "2026-07-01T03:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T02:05:12.711Z",
      "x_nadsec_last_seen": "2026-05-30T02:05:12.711Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "209630"
      ],
      "x_nadsec_orgs": [
        "LLC Vash Kredit Bank"
      ]
    },
    {
      "created": "2026-05-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--35cd8418-0427-4df0-8e2b-dc4b445e1fb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.10.219.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:05:10.000Z",
      "valid_until": "2026-07-01T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T03:33:18.645Z",
      "x_nadsec_last_seen": "2026-05-30T03:35:23.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--365e732f-7cb4-46d8-8fe9-d81e24fb2ee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.107.36.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:05:10.000Z",
      "valid_until": "2026-07-01T04:05:09.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-05-30T03:08:56.573Z",
      "x_nadsec_last_seen": "2026-05-30T03:10:06.354Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a04087b5-cbf4-434f-abd9-4e355dc2ef20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:05:10.000Z",
      "valid_until": "2026-07-01T04:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T03:58:09.959Z",
      "x_nadsec_last_seen": "2026-05-30T03:58:09.959Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=24435; asn_org=Supernet Limited Transit Autonomous System Number",
      "id": "indicator--721787ee-0d2f-4fd5-ba3a-370389cda1d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.130.21.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:05:10.000Z",
      "valid_until": "2026-07-01T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T03:23:49.066Z",
      "x_nadsec_last_seen": "2026-05-30T03:23:49.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "24435"
      ],
      "x_nadsec_orgs": [
        "Supernet Limited Transit Autonomous System Number"
      ]
    },
    {
      "created": "2026-05-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--efe282a5-cdee-4b03-a22e-1cdffefc8a6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:05:10.000Z",
      "valid_until": "2026-07-01T04:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T03:28:22.267Z",
      "x_nadsec_last_seen": "2026-05-30T21:28:29.411Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-30T04:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--beb5deda-a9b5-4f6c-b3d8-825b3bf3d8a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T04:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.4.131.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:05:10.000Z",
      "valid_until": "2026-07-01T04:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T03:33:15.447Z",
      "x_nadsec_last_seen": "2026-05-30T03:33:15.714Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133255; asn_org=Elxer Communications Private Limited",
      "id": "indicator--7001ccbe-238f-46af-9969-3bc11ff7ea1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.39.236.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T04:17:27.245Z",
      "x_nadsec_last_seen": "2026-05-30T04:17:54.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133255"
      ],
      "x_nadsec_orgs": [
        "Elxer Communications Private Limited"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=21056; asn_org=Vianova S.p.A",
      "id": "indicator--30261058-b764-4ca4-ab4e-09ab76c7ad6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.61.187.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T04:35:55.543Z",
      "x_nadsec_last_seen": "2026-05-30T04:42:58.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "21056"
      ],
      "x_nadsec_orgs": [
        "Vianova S.p.A"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--cb21a98a-d4c6-4d19-b993-0fc446e79f90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.138.130.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T04:44:54.494Z",
      "x_nadsec_last_seen": "2026-05-30T04:51:28.433Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--725d4513-3a98-4a02-91ac-3f365512135c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.167.102.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T04:27:53.786Z",
      "x_nadsec_last_seen": "2026-05-30T04:29:58.525Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--a2806bbc-0710-4532-9f3a-75857e76f407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.232.196.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T04:47:14.977Z",
      "x_nadsec_last_seen": "2026-05-30T04:49:27.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "58224"
      ],
      "x_nadsec_orgs": [
        "Iran Telecommunication Company PJS"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263650; asn_org=Clicfacil Telecom",
      "id": "indicator--9abf5f97-7a7b-42ba-8378-8dd2032eddc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.74.157.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T04:45:49.979Z",
      "x_nadsec_last_seen": "2026-05-30T04:47:57.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263650"
      ],
      "x_nadsec_orgs": [
        "Clicfacil Telecom"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--544c9bb9-8e23-409b-92a2-9caf957a25c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.107.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T04:41:42.620Z",
      "x_nadsec_last_seen": "2026-05-30T04:41:42.620Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=200845; asn_org=Avatel Telecom, SA",
      "id": "indicator--220f2897-c1b4-4e7e-9105-6d65cd883dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.104.161.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T04:23:46.066Z",
      "x_nadsec_last_seen": "2026-05-30T04:25:52.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "200845"
      ],
      "x_nadsec_orgs": [
        "Avatel Telecom, SA"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--eea814bd-41a1-4755-83ae-afa4bd73b3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.6.43.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T04:19:51.485Z",
      "x_nadsec_last_seen": "2026-05-30T04:26:54.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-05-30T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a99958e2-178a-4ad4-8c29-78727dc4b627",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.75.164.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T05:05:11.000Z",
      "valid_until": "2026-07-01T05:05:08.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-30T04:11:46.262Z",
      "x_nadsec_last_seen": "2026-05-30T04:11:59.746Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--4431963c-0444-4f12-ad74-15c8bf3726dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.164.248.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T05:20:53.778Z",
      "x_nadsec_last_seen": "2026-05-30T05:21:18.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e58c22c1-fad2-45e3-9cb4-3122d43413be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.249.74.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T05:21:38.905Z",
      "x_nadsec_last_seen": "2026-05-30T05:23:43.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--272ce99d-a00c-4efb-b9ff-8e4dfa3aee3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T05:52:45.624Z",
      "x_nadsec_last_seen": "2026-05-30T05:52:45.624Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--1c8ea620-7542-4a75-8904-40d9ec333087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '201.138.228.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T05:15:34.827Z",
      "x_nadsec_last_seen": "2026-05-30T05:22:38.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--15404d08-70e6-4cad-a9b4-bb80eb42d9f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.219.245.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T05:05:06.872Z",
      "x_nadsec_last_seen": "2026-05-30T05:13:44.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "58224"
      ],
      "x_nadsec_orgs": [
        "Iran Telecommunication Company PJS"
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--3403aac4-c857-4417-8c8d-f8f0f4dbd598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.85.50.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T05:40:50.398Z",
      "x_nadsec_last_seen": "2026-05-30T05:40:50.398Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--99c62a6d-56b1-432a-9625-f513db14d74d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.182.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T05:54:53.393Z",
      "x_nadsec_last_seen": "2026-05-30T05:55:24.512Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-30T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--67eaafe4-9327-4bab-a6d1-bac484ded4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.38.85.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:05:10.000Z",
      "valid_until": "2026-07-01T06:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T05:54:14.051Z",
      "x_nadsec_last_seen": "2026-05-30T05:54:14.051Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-30T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--5a83ed0f-30b0-4362-aa84-3fae6f46b503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.163.39.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:05:11.000Z",
      "valid_until": "2026-07-01T07:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T06:49:49.558Z",
      "x_nadsec_last_seen": "2026-05-30T06:57:09.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-30T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d5772af8-bae1-4f82-9ccd-0e5476d49734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.47.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:05:11.000Z",
      "valid_until": "2026-07-01T07:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-30T06:39:56.286Z",
      "x_nadsec_last_seen": "2026-05-30T06:40:37.694Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-30T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=38365; asn_org=Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "id": "indicator--3bda8182-fac4-475c-8925-6fdb02158569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.49.64.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:05:11.000Z",
      "valid_until": "2026-07-01T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T06:38:28.268Z",
      "x_nadsec_last_seen": "2026-05-30T06:38:28.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "38365"
      ],
      "x_nadsec_orgs": [
        "Beijing Baidu Netcom Science and Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-30T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--549fd3cd-4567-4f4f-8893-1cea8384fa30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.227.52.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:05:11.000Z",
      "valid_until": "2026-07-01T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T06:16:39.071Z",
      "x_nadsec_last_seen": "2026-05-30T06:18:43.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4e7f7362-ae51-4435-bb98-2ee7590ab99f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.248.2.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:05:11.000Z",
      "valid_until": "2026-07-01T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T06:25:23.257Z",
      "x_nadsec_last_seen": "2026-05-30T06:27:30.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--23831790-8833-434c-bc02-a4a718d8c31d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.205.25.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T07:55:41.601Z",
      "x_nadsec_last_seen": "2026-05-30T07:57:46.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--86bc7fca-8944-4e25-9e33-21ad4d233358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.191.174.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T07:11:13.667Z",
      "x_nadsec_last_seen": "2026-05-30T07:13:18.434Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--300bb3de-f582-4536-856b-97638d843028",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.232.178.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T07:13:16.031Z",
      "x_nadsec_last_seen": "2026-05-30T07:15:20.817Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ba0267be-675f-48d1-8e13-1588095e2c48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.224.180.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T07:06:17.764Z",
      "x_nadsec_last_seen": "2026-05-30T07:08:22.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a12ef09b-7267-42e0-a3fe-be3279ad735d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.249.161.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T07:30:05.446Z",
      "x_nadsec_last_seen": "2026-05-30T07:32:10.244Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ES; asn=202054; asn_org=Grupo Sys4net, S.l.",
      "id": "indicator--479d7705-b1b7-45b7-ab1f-d1e3d22d617b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.14.58.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T07:30:00.245Z",
      "x_nadsec_last_seen": "2026-05-30T07:30:00.245Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "202054"
      ],
      "x_nadsec_orgs": [
        "Grupo Sys4net, S.l."
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--3ff53e36-0606-4f96-97d4-5d5d880b0eeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.249.230.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T07:43:00.863Z",
      "x_nadsec_last_seen": "2026-05-30T07:49:23.560Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--97adae0c-7777-4773-a4bd-5a3dc4afb282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.165.80.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T07:27:10.520Z",
      "x_nadsec_last_seen": "2026-05-30T07:27:11.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--c99b2d64-452a-494e-be2b-462a6b50bd75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.4.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:05:10.000Z",
      "valid_until": "2026-07-01T08:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T07:30:44.690Z",
      "x_nadsec_last_seen": "2026-05-30T07:31:08.565Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-30T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--2159c48d-fdd6-44c6-8ac2-b253d1f598cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.70.80.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:05:11.000Z",
      "valid_until": "2026-07-01T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T08:26:02.917Z",
      "x_nadsec_last_seen": "2026-05-30T08:28:08.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-30T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9b728d79-71b0-42e4-97fe-cca873ae6a8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.81.56.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:05:11.000Z",
      "valid_until": "2026-07-01T09:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-30T08:39:50.475Z",
      "x_nadsec_last_seen": "2026-05-30T09:56:54.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-30T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=62068; asn_org=SpectraIP B.V.",
      "id": "indicator--dbd65ebf-c004-4c0e-98b5-9828c0bac05e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.148.120.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:05:11.000Z",
      "valid_until": "2026-07-01T09:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T08:38:03.481Z",
      "x_nadsec_last_seen": "2026-05-30T08:38:03.481Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "62068"
      ],
      "x_nadsec_orgs": [
        "SpectraIP B.V."
      ]
    },
    {
      "created": "2026-05-30T09:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=5650; asn_org=Frontier Communications of America, Inc.",
      "id": "indicator--de7b7d87-5f9a-4498-8e0e-2a7546340fc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T09:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.190.20.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:05:11.000Z",
      "valid_until": "2026-07-01T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T08:42:29.385Z",
      "x_nadsec_last_seen": "2026-05-30T08:44:34.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5650"
      ],
      "x_nadsec_orgs": [
        "Frontier Communications of America, Inc."
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--bbad844f-bc56-4af8-838b-630ec987687b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.153.104.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T10:03:35.327Z",
      "x_nadsec_last_seen": "2026-05-30T10:05:41.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f17f4bf1-939f-498f-ab6a-d12276d09819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.25.116.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T09:37:07.209Z",
      "x_nadsec_last_seen": "2026-05-30T09:39:12.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--34415e7b-3b08-4934-a9e6-b4354b7aea53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.235.166.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T10:04:48.994Z",
      "x_nadsec_last_seen": "2026-05-30T10:06:55.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f0bac49d-42d8-46bc-9de0-852c4ad363a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.110.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T09:47:09.099Z",
      "x_nadsec_last_seen": "2026-05-30T09:53:52.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--47a400b6-85af-4ee2-bf4a-582b39d460c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T09:05:19.290Z",
      "x_nadsec_last_seen": "2026-05-30T09:05:19.564Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--fc638150-91a3-4b05-8253-097c4211683e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.176.186.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T09:10:31.159Z",
      "x_nadsec_last_seen": "2026-05-30T09:10:31.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47165; asn_org=Omskie kabelnye seti Ltd.",
      "id": "indicator--b3c8412e-bc1f-429a-bd7b-9bbc3c39c8e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.74.103.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T09:13:01.510Z",
      "x_nadsec_last_seen": "2026-05-30T09:15:08.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47165"
      ],
      "x_nadsec_orgs": [
        "Omskie kabelnye seti Ltd."
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=12444; asn_org=Telnet Telekom Hizmetleri Anonim Sirketi",
      "id": "indicator--9f06cbd1-95ab-44e8-b080-0ac840aa297a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.118.178.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T09:39:43.576Z",
      "x_nadsec_last_seen": "2026-05-30T09:41:50.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12444"
      ],
      "x_nadsec_orgs": [
        "Telnet Telekom Hizmetleri Anonim Sirketi"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--90326f84-4878-413b-b808-7a87172a37fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T09:35:34.347Z",
      "x_nadsec_last_seen": "2026-05-30T09:35:34.666Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8416; asn_org=InfoLada Ltd",
      "id": "indicator--80bf01a3-cfb0-4fb7-bfcc-ba12b5a97880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.113.124.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T09:40:58.514Z",
      "x_nadsec_last_seen": "2026-05-30T09:48:28.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8416"
      ],
      "x_nadsec_orgs": [
        "InfoLada Ltd"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--799737c3-498f-4502-addd-5ede02945604",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.252.182.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T09:51:36.686Z",
      "x_nadsec_last_seen": "2026-05-30T09:53:41.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HR; asn=35549; asn_org=A1 Hrvatska d.o.o.",
      "id": "indicator--2e27ee0d-05a6-4c74-bd72-e4b4f594c2b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.134.217.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:05:13.000Z",
      "valid_until": "2026-07-01T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T09:12:37.913Z",
      "x_nadsec_last_seen": "2026-05-30T09:19:37.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HR"
      ],
      "x_nadsec_asns": [
        "35549"
      ],
      "x_nadsec_orgs": [
        "A1 Hrvatska d.o.o."
      ]
    },
    {
      "created": "2026-05-30T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135780; asn_org=AirFiber Networks Pvt Ltd",
      "id": "indicator--9331fa22-6ec5-423e-95c3-be911bf4068f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.122.15.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:05:10.000Z",
      "valid_until": "2026-07-01T11:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T10:49:33.455Z",
      "x_nadsec_last_seen": "2026-05-30T10:51:39.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135780"
      ],
      "x_nadsec_orgs": [
        "AirFiber Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-30T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--5ca91305-f6ad-4ce5-b2ba-06f067cf9fcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.185.161.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:05:10.000Z",
      "valid_until": "2026-07-01T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T10:41:25.545Z",
      "x_nadsec_last_seen": "2026-05-30T10:41:36.611Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--2eb87225-785c-4576-b5f3-a0d6606a89ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.123.147.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:05:10.000Z",
      "valid_until": "2026-07-01T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T10:42:39.712Z",
      "x_nadsec_last_seen": "2026-05-30T10:49:15.991Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-05-30T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=14868; asn_org=Ligga Telecomunicacoes S.A.",
      "id": "indicator--76fb6e5d-6db7-49fc-a0a0-142a012452f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.150.78.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:05:10.000Z",
      "valid_until": "2026-07-01T11:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-30T11:04:26.678Z",
      "x_nadsec_last_seen": "2026-05-30T11:35:55.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "14868"
      ],
      "x_nadsec_orgs": [
        "Ligga Telecomunicacoes S.A."
      ]
    },
    {
      "created": "2026-05-30T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--6a1ccf8f-10e1-42d9-b56f-01643b3378a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:05:10.000Z",
      "valid_until": "2026-07-01T11:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T10:23:51.135Z",
      "x_nadsec_last_seen": "2026-05-30T10:24:01.134Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-30T12:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--f176011c-3e5c-405c-9195-58aa92057f1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T12:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.75.44.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:05:10.000Z",
      "valid_until": "2026-07-01T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T11:35:54.624Z",
      "x_nadsec_last_seen": "2026-05-30T11:38:01.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--061ef1c7-bc81-4151-b0ec-cb6b6bee44bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '105.118.3.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T12:18:46.188Z",
      "x_nadsec_last_seen": "2026-05-30T12:26:28.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--94b8650e-8524-44d7-a24b-8e2f80ffbe26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.84.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T12:41:51.260Z",
      "x_nadsec_last_seen": "2026-05-30T12:41:51.260Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--170ab6c9-8190-490d-914c-8d64f5dce090",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T12:59:24.692Z",
      "x_nadsec_last_seen": "2026-05-30T12:59:34.869Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=51612; asn_org=Alfatel plus Ltd",
      "id": "indicator--c16df00c-1e97-4415-95b4-4e6291beaaa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.119.20.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T12:50:14.467Z",
      "x_nadsec_last_seen": "2026-05-30T12:58:11.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51612"
      ],
      "x_nadsec_orgs": [
        "Alfatel plus Ltd"
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6ad40890-a989-4ade-8a03-00842d3739fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T12:55:44.283Z",
      "x_nadsec_last_seen": "2026-05-30T12:55:44.650Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--9169ab31-46fe-49e5-8b9b-99e66a758327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.208.113.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T12:37:18.711Z",
      "x_nadsec_last_seen": "2026-05-30T12:39:23.524Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32098"
      ],
      "x_nadsec_orgs": [
        "Transtelco Inc"
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--188167e7-c0ce-4784-b3fe-442e47bed7a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.150.61.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T12:50:59.825Z",
      "x_nadsec_last_seen": "2026-05-30T12:57:59.145Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-05-30T13:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--3e8632bc-f1ec-4683-b22f-f9a0f5916f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T13:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.25.144.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:05:10.000Z",
      "valid_until": "2026-07-01T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T12:21:11.163Z",
      "x_nadsec_last_seen": "2026-05-30T12:23:18.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-30T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--e44e0825-27e9-4213-9383-4a15b9ab32eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.80.169.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:05:21.000Z",
      "valid_until": "2026-07-01T14:05:16.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T13:45:43.483Z",
      "x_nadsec_last_seen": "2026-05-30T13:47:54.106Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-30T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b5887385-1639-4f07-9501-ffd4fd796652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.45.62.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:05:21.000Z",
      "valid_until": "2026-07-01T14:05:16.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T13:06:57.623Z",
      "x_nadsec_last_seen": "2026-05-30T13:09:02.475Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-30T14:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--48e19d7c-7ab6-459d-8205-1ef11844070d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T14:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.143.209.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T14:05:21.000Z",
      "valid_until": "2026-07-01T14:05:16.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T13:10:23.536Z",
      "x_nadsec_last_seen": "2026-05-30T13:13:42.878Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--2d43185f-e2df-406a-bbd1-a61379548e64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.158.171.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:05:25.000Z",
      "valid_until": "2026-07-01T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T14:48:31.444Z",
      "x_nadsec_last_seen": "2026-05-30T14:52:04.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-05-30T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--5445ce49-e724-40a6-8fc5-ab5931e1ce60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.98.37.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:05:25.000Z",
      "valid_until": "2026-07-01T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T14:09:51.144Z",
      "x_nadsec_last_seen": "2026-05-30T14:11:57.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-05-30T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--1da68c9d-1e4e-41a4-9c22-a8d44a30da61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.191.78.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:05:25.000Z",
      "valid_until": "2026-07-01T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T14:49:32.381Z",
      "x_nadsec_last_seen": "2026-05-30T14:54:25.348Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--e26fbf07-2083-4a21-8416-cace393d4e13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.248.147.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:05:25.000Z",
      "valid_until": "2026-07-01T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T14:23:28.333Z",
      "x_nadsec_last_seen": "2026-05-30T14:25:35.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-05-30T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--6a27be23-128a-43b8-8087-c28161895b91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.44.172.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:05:25.000Z",
      "valid_until": "2026-07-01T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T14:08:13.021Z",
      "x_nadsec_last_seen": "2026-05-30T14:15:21.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-05-30T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b7b0a58d-dc76-4410-8bc2-7f1afc555a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.74.156.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:05:25.000Z",
      "valid_until": "2026-07-01T15:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-30T14:24:41.249Z",
      "x_nadsec_last_seen": "2026-05-30T14:41:25.530Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-30T15:05:25.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--61109bab-db34-46ef-a41a-ded8dc6c8491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T15:05:25.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.228.162.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:05:25.000Z",
      "valid_until": "2026-07-01T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T14:56:05.681Z",
      "x_nadsec_last_seen": "2026-05-30T15:04:08.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132445; asn_org=Khetan Cable Network Pvt. Limited",
      "id": "indicator--f364dbbc-4fa9-4153-86fe-cb7c49032ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.21.55.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T15:46:38.992Z",
      "x_nadsec_last_seen": "2026-05-30T15:48:43.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132445"
      ],
      "x_nadsec_orgs": [
        "Khetan Cable Network Pvt. Limited"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BH; asn=51375; asn_org=Stc Bahrain B.s.c Closed; user(top)=**",
      "id": "indicator--ceee4d46-1871-4bc1-a061-a154d316b85c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.63.14.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T15:10:44.457Z",
      "x_nadsec_last_seen": "2026-05-30T15:10:44.457Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BH"
      ],
      "x_nadsec_asns": [
        "51375"
      ],
      "x_nadsec_orgs": [
        "Stc Bahrain B.s.c Closed"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--52740597-e179-4ba7-9e11-c09753561031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.212.87.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-30T15:42:00.783Z",
      "x_nadsec_last_seen": "2026-05-30T15:43:45.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--05dcecb4-27eb-43f4-b12d-89d5c09cff25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.158.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T15:32:54.176Z",
      "x_nadsec_last_seen": "2026-05-31T16:37:09.450Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35598; asn_org=Inetcom Carrier LLC",
      "id": "indicator--76f47aca-f8d2-4dbb-9d43-af2b9e54dd1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.99.138.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T15:49:19.846Z",
      "x_nadsec_last_seen": "2026-05-30T15:51:26.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35598"
      ],
      "x_nadsec_orgs": [
        "Inetcom Carrier LLC"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=27831; asn_org=Colombia Movil",
      "id": "indicator--ea10812a-005d-4f32-ad36-347cf0902095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.253.100.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T15:29:44.268Z",
      "x_nadsec_last_seen": "2026-05-30T15:33:57.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27831"
      ],
      "x_nadsec_orgs": [
        "Colombia Movil"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--ef48fd5e-4b63-4b4c-ab64-a360c801f494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.83.255.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T15:52:21.825Z",
      "x_nadsec_last_seen": "2026-05-30T15:54:29.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=8570; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--bb133bcd-bb26-4e99-bae0-291a2bb2f681",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.34.238.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T15:17:56.145Z",
      "x_nadsec_last_seen": "2026-05-30T15:17:56.145Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8570"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7c202841-b00e-49c4-9acd-bc35a30b55a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.22.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-05-30T15:30:01.921Z",
      "x_nadsec_last_seen": "2026-05-30T15:32:50.939Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--87a7f4ac-63a3-4b9b-9a92-5b878b3b8c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.180.151.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T15:49:21.665Z",
      "x_nadsec_last_seen": "2026-05-30T15:56:23.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-30T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IR; asn=39074; asn_org=Sepanta Communication Development Co. Ltd",
      "id": "indicator--76dec1c2-2e95-4b7e-ae79-a6a218c7fcae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.133.167.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:05:10.000Z",
      "valid_until": "2026-07-01T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T15:29:40.272Z",
      "x_nadsec_last_seen": "2026-05-30T15:32:13.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "39074"
      ],
      "x_nadsec_orgs": [
        "Sepanta Communication Development Co. Ltd"
      ]
    },
    {
      "created": "2026-05-30T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--dadc38d1-d807-426b-8260-9c617c9fc381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.169.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:05:10.000Z",
      "valid_until": "2026-07-01T17:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-30T16:10:01.030Z",
      "x_nadsec_last_seen": "2026-05-30T16:12:06.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-30T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GT; asn=14754; asn_org=TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA",
      "id": "indicator--6579779c-8132-4602-b8b8-ba7e038fa880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.149.74.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:05:10.000Z",
      "valid_until": "2026-07-01T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T16:32:30.788Z",
      "x_nadsec_last_seen": "2026-05-30T16:34:36.577Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GT"
      ],
      "x_nadsec_asns": [
        "14754"
      ],
      "x_nadsec_orgs": [
        "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-05-30T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e5a320f1-b2cf-4b97-b7b8-9422bb2c6d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.138.151.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:05:10.000Z",
      "valid_until": "2026-07-01T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T16:38:26.219Z",
      "x_nadsec_last_seen": "2026-05-30T16:42:25.527Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8c48655a-10ef-46eb-bf63-5cca3822c339",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.145.2.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:05:10.000Z",
      "valid_until": "2026-07-01T17:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T16:24:32.151Z",
      "x_nadsec_last_seen": "2026-05-30T16:24:32.151Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--73729bec-1df6-46c5-aa3a-5f2e526b1da9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.14.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:05:10.000Z",
      "valid_until": "2026-07-01T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T16:36:57.397Z",
      "x_nadsec_last_seen": "2026-05-30T16:39:04.983Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-30T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=21487; asn_org=Rostelecom",
      "id": "indicator--12b1a1ef-9e4e-4140-942f-406b6087499e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.73.67.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:05:10.000Z",
      "valid_until": "2026-07-01T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T16:46:23.688Z",
      "x_nadsec_last_seen": "2026-05-30T16:48:30.103Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21487"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-30T17:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HR; asn=5391; asn_org=Hrvatski Telekom d.d.",
      "id": "indicator--26586d55-53ca-4372-b33f-386cde5d418d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T17:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.138.3.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:05:10.000Z",
      "valid_until": "2026-07-01T17:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T16:56:22.025Z",
      "x_nadsec_last_seen": "2026-05-30T17:03:16.933Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HR"
      ],
      "x_nadsec_asns": [
        "5391"
      ],
      "x_nadsec_orgs": [
        "Hrvatski Telekom d.d."
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--921cad6e-2a30-454e-b57a-b440efae6d93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.249.17.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T17:08:57.606Z",
      "x_nadsec_last_seen": "2026-05-30T17:15:30.168Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=137967; asn_org=Digicon Telecommunication Ltd",
      "id": "indicator--1a95037b-10ba-4559-98db-5b9228563e6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.204.151.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T17:06:53.298Z",
      "x_nadsec_last_seen": "2026-05-30T17:06:53.298Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "137967"
      ],
      "x_nadsec_orgs": [
        "Digicon Telecommunication Ltd"
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=137967; asn_org=Digicon Telecommunication Ltd",
      "id": "indicator--1a4f22eb-3449-4644-aa01-6e136e3e14bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.204.151.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T17:06:53.245Z",
      "x_nadsec_last_seen": "2026-05-30T17:06:53.245Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "137967"
      ],
      "x_nadsec_orgs": [
        "Digicon Telecommunication Ltd"
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fccc9f42-04e2-4e60-9a22-5b9d9cd3e73c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.245.247.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T17:49:46.409Z",
      "x_nadsec_last_seen": "2026-05-30T17:49:46.409Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--1aad4a81-350f-4ac7-9b96-a8f3053f9cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.234.187.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T17:47:37.984Z",
      "x_nadsec_last_seen": "2026-05-30T17:49:45.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=50477; asn_org=Svyaz-Energo Ltd.",
      "id": "indicator--09d6cadb-5fa1-4967-b498-1c90a3eb5ed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.19.114.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T17:52:20.754Z",
      "x_nadsec_last_seen": "2026-05-30T17:52:20.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50477"
      ],
      "x_nadsec_orgs": [
        "Svyaz-Energo Ltd."
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--22443efd-7d9a-45ff-829d-7d989582179b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.40.188.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T17:30:03.656Z",
      "x_nadsec_last_seen": "2026-05-30T17:37:49.220Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=35753; asn_org=Etihad Salam Telecom CJSC",
      "id": "indicator--a47744e8-12ad-4621-a6cd-277154c7a012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.167.223.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T17:29:21.060Z",
      "x_nadsec_last_seen": "2026-05-30T17:31:28.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35753"
      ],
      "x_nadsec_orgs": [
        "Etihad Salam Telecom CJSC"
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--820cc459-4798-4d82-8ddb-595ec0cc44da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T17:26:52.804Z",
      "x_nadsec_last_seen": "2026-05-30T17:26:52.804Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-30T18:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--89255984-9d79-491a-96ee-b9df5efc25ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T18:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T18:05:11.000Z",
      "valid_until": "2026-07-01T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T17:26:26.531Z",
      "x_nadsec_last_seen": "2026-05-30T17:26:26.531Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-30T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--196797eb-f946-45cd-83fe-eebc98dfb6af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.173.51.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:05:10.000Z",
      "valid_until": "2026-07-01T19:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-30T18:37:48.279Z",
      "x_nadsec_last_seen": "2026-05-31T04:35:44.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-30T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=273490; asn_org=FIBRION INTERNET LTDA",
      "id": "indicator--77847f4c-cef7-41e9-a142-6c9caa1c60a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '131.255.100.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:05:10.000Z",
      "valid_until": "2026-07-01T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T18:14:34.834Z",
      "x_nadsec_last_seen": "2026-05-30T18:16:41.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "273490"
      ],
      "x_nadsec_orgs": [
        "FIBRION INTERNET LTDA"
      ]
    },
    {
      "created": "2026-05-30T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f4030ddb-618d-4259-9f0b-2e8e965e1049",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.166.160.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:05:10.000Z",
      "valid_until": "2026-07-01T19:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T18:10:43.780Z",
      "x_nadsec_last_seen": "2026-05-30T18:17:20.990Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=12389; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--e9df8461-52ba-4965-be59-9a8217b01342",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.211.30.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:05:10.000Z",
      "valid_until": "2026-07-01T19:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T18:21:28.691Z",
      "x_nadsec_last_seen": "2026-05-30T18:21:30.022Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-30T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=52783; asn_org=ALCANS TELECOM LTDA",
      "id": "indicator--4883c6e5-e94d-4f37-9fc0-9458e6ef878a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.200.66.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:05:10.000Z",
      "valid_until": "2026-07-01T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T18:50:44.933Z",
      "x_nadsec_last_seen": "2026-05-30T18:50:44.933Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52783"
      ],
      "x_nadsec_orgs": [
        "ALCANS TELECOM LTDA"
      ]
    },
    {
      "created": "2026-05-30T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--6aae398d-755a-4836-b70b-1bfd792712aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.52.56.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:05:10.000Z",
      "valid_until": "2026-07-01T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T18:24:07.405Z",
      "x_nadsec_last_seen": "2026-05-30T18:26:11.948Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-30T19:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--dbafae72-3b5f-4bea-af57-0ef05ae87bb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T19:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.246.5.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T19:05:10.000Z",
      "valid_until": "2026-07-01T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T18:05:37.222Z",
      "x_nadsec_last_seen": "2026-05-30T18:07:43.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-05-30T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--ddc9a389-2de2-42b7-a44c-f98ed27f9bce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '200.246.161.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:05:11.000Z",
      "valid_until": "2026-07-01T20:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T19:33:30.275Z",
      "x_nadsec_last_seen": "2026-05-30T19:35:37.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-05-30T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=23966; asn_org=LINKdotNET Telecom Limited",
      "id": "indicator--6030dd0e-b1f4-4972-a141-bbc10d3a5f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.2.130.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:05:11.000Z",
      "valid_until": "2026-07-01T20:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T19:40:11.926Z",
      "x_nadsec_last_seen": "2026-05-30T19:40:11.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23966"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET Telecom Limited"
      ]
    },
    {
      "created": "2026-05-30T20:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--6db60f5b-fb81-4580-b442-933ea2ca13cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T20:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.183.220.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T20:05:11.000Z",
      "valid_until": "2026-07-01T20:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T19:19:27.891Z",
      "x_nadsec_last_seen": "2026-05-30T19:19:27.891Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-30T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=24435; asn_org=Supernet Limited Transit Autonomous System Number",
      "id": "indicator--2a62427e-bf35-435a-9722-51d07f6db760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.0.37.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:05:05.000Z",
      "valid_until": "2026-07-01T21:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T20:46:24.276Z",
      "x_nadsec_last_seen": "2026-05-30T20:48:30.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "24435"
      ],
      "x_nadsec_orgs": [
        "Supernet Limited Transit Autonomous System Number"
      ]
    },
    {
      "created": "2026-05-30T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--806f73bf-edee-4956-b647-b8e5f7233909",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.235.41.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:05:05.000Z",
      "valid_until": "2026-07-01T21:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T20:20:50.575Z",
      "x_nadsec_last_seen": "2026-05-30T20:20:50.849Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-30T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=FI; asn=203003; asn_org=Magna Capax Finland Oy",
      "id": "indicator--2bbbf436-9e81-4962-9ae4-96a04293571e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.148.3.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:05:05.000Z",
      "valid_until": "2026-07-01T21:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T20:44:09.733Z",
      "x_nadsec_last_seen": "2026-05-30T20:44:10.326Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FI"
      ],
      "x_nadsec_asns": [
        "203003"
      ],
      "x_nadsec_orgs": [
        "Magna Capax Finland Oy"
      ]
    },
    {
      "created": "2026-05-30T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ac9dd43f-2ffa-4a38-b253-e54c8fc02f59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.86.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:05:05.000Z",
      "valid_until": "2026-07-01T21:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T20:58:51.395Z",
      "x_nadsec_last_seen": "2026-05-30T20:58:51.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-30T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--08b21604-08f5-4626-9971-90de963bb8c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.253.5.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:05:05.000Z",
      "valid_until": "2026-07-01T21:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T20:24:21.611Z",
      "x_nadsec_last_seen": "2026-05-30T20:26:27.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-30T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--e1ec8c5f-9005-4795-99ce-288d5de1fe1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.129.87.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:05:05.000Z",
      "valid_until": "2026-07-01T21:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T20:33:03.823Z",
      "x_nadsec_last_seen": "2026-05-30T20:35:19.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-05-30T21:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--eacd8e4c-d42f-4874-909b-5db4a588a20f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T21:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.7.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T21:05:05.000Z",
      "valid_until": "2026-07-01T21:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T20:26:32.657Z",
      "x_nadsec_last_seen": "2026-05-30T20:26:32.657Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-30T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=23487; asn_org=CONECEL",
      "id": "indicator--63af8edb-d359-4cc6-88da-0c7d54137bc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.63.117.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:05:10.000Z",
      "valid_until": "2026-07-01T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T21:08:48.731Z",
      "x_nadsec_last_seen": "2026-05-30T21:08:57.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "23487"
      ],
      "x_nadsec_orgs": [
        "CONECEL"
      ]
    },
    {
      "created": "2026-05-30T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8e60cd33-9f53-40f1-ac85-b18095c76fad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.47.51.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:05:10.000Z",
      "valid_until": "2026-07-01T22:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-05-30T21:12:59.106Z",
      "x_nadsec_last_seen": "2026-05-30T21:29:56.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-30T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--72374af7-af77-4ff1-9302-4041df1ba5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:05:10.000Z",
      "valid_until": "2026-07-01T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T21:09:57.214Z",
      "x_nadsec_last_seen": "2026-05-30T21:10:07.373Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-30T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fd97000c-73d4-4f94-ac39-cd9fcc5c2bc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.104.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:05:10.000Z",
      "valid_until": "2026-07-01T22:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T21:54:28.843Z",
      "x_nadsec_last_seen": "2026-05-30T21:56:35.033Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-30T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:05:10.000Z",
      "valid_until": "2026-07-01T22:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T21:38:00.720Z",
      "x_nadsec_last_seen": "2026-05-30T21:38:00.720Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4ca9b403-4f66-481f-8a8b-857f6c53ebaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.34.238.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-30T22:23:33.919Z",
      "x_nadsec_last_seen": "2026-05-30T23:05:45.887Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=58309; asn_org=Langate Ltd",
      "id": "indicator--e0526d5b-7402-436b-b8ee-25ad8485f318",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.120.61.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T22:23:06.242Z",
      "x_nadsec_last_seen": "2026-05-30T22:25:12.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "58309"
      ],
      "x_nadsec_orgs": [
        "Langate Ltd"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--5b10eeef-ca17-49cd-be39-2598a1f97fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.155.90.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T22:40:28.803Z",
      "x_nadsec_last_seen": "2026-05-30T22:40:58.799Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=51; services=ftpd; ports=21; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; user(top)=***; pass(top)=p**s",
      "id": "indicator--3245f218-705a-472a-8acb-b74f35e0f9c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.98.170.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 846,
      "x_nadsec_first_seen": "2026-05-30T22:36:31.561Z",
      "x_nadsec_last_seen": "2026-05-31T06:34:22.033Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "a***n",
        "a***********r",
        "**",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "t**t",
        "0****0",
        "***",
        "1****3",
        "1****1"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--5d7d5e3d-032f-4227-9383-bba7a8308a44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-20T16:36:17.578Z",
      "x_nadsec_last_seen": "2026-05-30T23:03:15.635Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--a00ce505-5f52-4b3f-adee-37c4364ba5b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T22:09:54.927Z",
      "x_nadsec_last_seen": "2026-05-30T22:09:54.927Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce1fc6d2-88e3-4589-9c2f-ca16018dae9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T23:04:13.968Z",
      "x_nadsec_last_seen": "2026-05-30T23:04:13.968Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5e3b0182-ec9e-4037-b70a-e98d012a3e06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T23:04:39.999Z",
      "x_nadsec_last_seen": "2026-05-30T23:04:39.999Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b8de0a91-3a7e-4dfe-b646-769de1aeb66b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T23:04:39.807Z",
      "x_nadsec_last_seen": "2026-05-30T23:04:39.807Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-30T23:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2360db1a-be83-40a2-b332-e01c42260786",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-30T23:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T23:05:05.000Z",
      "valid_until": "2026-07-01T23:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T23:04:13.798Z",
      "x_nadsec_last_seen": "2026-05-30T23:04:13.798Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-31T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TG; asn=328282; asn_org=TEOLIS-SAU",
      "id": "indicator--8d9d3321-c5c1-47a8-97b6-97be124cbea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.164.230.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:05:05.000Z",
      "valid_until": "2026-07-02T00:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-30T23:12:45.058Z",
      "x_nadsec_last_seen": "2026-05-30T23:19:55.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TG"
      ],
      "x_nadsec_asns": [
        "328282"
      ],
      "x_nadsec_orgs": [
        "TEOLIS-SAU"
      ]
    },
    {
      "created": "2026-05-31T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--cd7841ff-443d-4ac6-a6c4-c4a1f172c230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.206.2.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:05:05.000Z",
      "valid_until": "2026-07-02T00:05:03.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-30T23:44:36.873Z",
      "x_nadsec_last_seen": "2026-05-31T00:15:27.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-31T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--040e6a2d-3d24-4223-bc07-980802a209ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.152.157.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:05:05.000Z",
      "valid_until": "2026-07-02T00:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-30T23:44:32.462Z",
      "x_nadsec_last_seen": "2026-05-30T23:44:32.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-31T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=20055; asn_org=Wholesail networks LLC",
      "id": "indicator--c7b4e5f8-4ac6-425d-8b44-4440333b7675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '50.54.244.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:05:05.000Z",
      "valid_until": "2026-07-02T00:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-30T23:46:35.688Z",
      "x_nadsec_last_seen": "2026-05-30T23:48:40.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "20055"
      ],
      "x_nadsec_orgs": [
        "Wholesail networks LLC"
      ]
    },
    {
      "created": "2026-05-31T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--81d5fa00-4f1a-4173-9eee-b9787eef77d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:05:05.000Z",
      "valid_until": "2026-07-02T00:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-30T23:35:58.136Z",
      "x_nadsec_last_seen": "2026-05-30T23:35:58.136Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-31T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--300d8dc5-0f31-4af4-bb3e-dd453327886f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.235.41.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:05:10.000Z",
      "valid_until": "2026-07-02T01:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T00:36:15.999Z",
      "x_nadsec_last_seen": "2026-05-31T00:36:46.001Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-31T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--aab9c233-7620-4d40-8d41-4ed91de54a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.68.167.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:05:10.000Z",
      "valid_until": "2026-07-02T01:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T00:13:56.924Z",
      "x_nadsec_last_seen": "2026-05-31T00:16:03.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-31T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--1d70dfcf-15e5-4eca-a07e-7037fd59da3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.77.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:05:10.000Z",
      "valid_until": "2026-07-02T01:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T00:11:34.039Z",
      "x_nadsec_last_seen": "2026-05-31T00:16:38.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--f596e140-27ee-47b2-a855-633718690a65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.51.198.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T02:02:31.289Z",
      "x_nadsec_last_seen": "2026-05-31T02:02:31.289Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--3174eafb-1ab1-4cf6-9d5e-92d136957375",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '16.59.212.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-05-31T01:53:54.564Z",
      "x_nadsec_last_seen": "2026-05-31T03:29:46.544Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1e943582-d522-4d93-9b27-7c49963d8e15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.90.190.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T02:04:48.724Z",
      "x_nadsec_last_seen": "2026-05-31T02:04:48.724Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262896; asn_org=SpeedWeb Net Telecomunicacoes",
      "id": "indicator--edf71903-3530-4c41-9a50-a2de753d60ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.23.146.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T01:25:15.501Z",
      "x_nadsec_last_seen": "2026-05-31T01:27:22.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262896"
      ],
      "x_nadsec_orgs": [
        "SpeedWeb Net Telecomunicacoes"
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d81c3807-7bd4-4aca-9882-8e930334339a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.250.159.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T01:35:20.422Z",
      "x_nadsec_last_seen": "2026-05-31T01:37:25.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9e8f0084-2493-451d-b809-ccaa78ce5d50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.0.113.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T01:31:35.493Z",
      "x_nadsec_last_seen": "2026-05-31T01:33:42.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--73a2a6a1-4fcd-4d77-bdfc-5f79f8bbeb86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.203.254.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T01:29:49.626Z",
      "x_nadsec_last_seen": "2026-05-31T01:36:59.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-05-31T02:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UG; asn=20294; asn_org=MTN",
      "id": "indicator--bf38fdc8-ca15-40cc-9cf4-36735dce4cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T02:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.210.131.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:05:08.000Z",
      "valid_until": "2026-07-02T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T01:20:11.723Z",
      "x_nadsec_last_seen": "2026-05-31T01:20:11.780Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UG"
      ],
      "x_nadsec_asns": [
        "20294"
      ],
      "x_nadsec_orgs": [
        "MTN"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=55699; asn_org=PT. Cemerlang Multimedia",
      "id": "indicator--b13bab08-d085-4fc6-944c-0a8640e454cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.107.246.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T02:59:26.215Z",
      "x_nadsec_last_seen": "2026-05-31T02:59:30.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55699"
      ],
      "x_nadsec_orgs": [
        "PT. Cemerlang Multimedia"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=55699; asn_org=PT. Cemerlang Multimedia",
      "id": "indicator--d56fca11-2b26-4cba-9174-400c92415278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.19.227.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T02:59:26.104Z",
      "x_nadsec_last_seen": "2026-05-31T02:59:29.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55699"
      ],
      "x_nadsec_orgs": [
        "PT. Cemerlang Multimedia"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=CH; asn=51852; asn_org=Private Layer INC",
      "id": "indicator--d5622184-0961-4336-b615-e93be6684d80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.43.134.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T02:23:07.591Z",
      "x_nadsec_last_seen": "2026-05-31T19:16:05.096Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "51852"
      ],
      "x_nadsec_orgs": [
        "Private Layer INC"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=59497; asn_org=Buknet LLC",
      "id": "indicator--8c0d6964-36de-4f8a-b902-24744ceef214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.44.97.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T02:21:04.085Z",
      "x_nadsec_last_seen": "2026-05-31T02:27:57.722Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "59497"
      ],
      "x_nadsec_orgs": [
        "Buknet LLC"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--78738ae7-75e2-4717-915f-e46aede60694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.120.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T02:31:36.687Z",
      "x_nadsec_last_seen": "2026-05-31T02:31:36.687Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--c5a3e776-4560-42d0-831d-d763b0f6ea94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.114.186.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-31T02:11:59.077Z",
      "x_nadsec_last_seen": "2026-05-31T02:36:15.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=34296; asn_org=Millenicom Telekomunikasyon Hizmetleri Anonim Sirketi",
      "id": "indicator--70ef5fc0-421c-4684-8eec-2ab18ad90785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.1.106.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T02:52:51.224Z",
      "x_nadsec_last_seen": "2026-05-31T02:52:51.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34296"
      ],
      "x_nadsec_orgs": [
        "Millenicom Telekomunikasyon Hizmetleri Anonim Sirketi"
      ]
    },
    {
      "created": "2026-05-31T03:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0f306129-5737-4691-8f43-e1a76390c024",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T03:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.93.55.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:05:10.000Z",
      "valid_until": "2026-07-02T03:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T02:28:01.863Z",
      "x_nadsec_last_seen": "2026-05-31T02:30:08.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--58787ca8-e734-4bf6-b533-5b2aaa06b62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T03:35:48.694Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:10.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f8296f25-ca91-4003-8ed6-12b3f3b1444b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T03:35:25.586Z",
      "x_nadsec_last_seen": "2026-05-31T03:35:25.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T03:35:29.085Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:16.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--47034d4f-94de-4414-93f7-9f8de54c47f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T03:36:14.293Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:14.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--18ba644f-a79f-429d-b9c5-ab4337551421",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T03:35:46.544Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:09.136Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8012b978-c08d-4c9c-bf86-97017a078085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T03:36:17.687Z",
      "x_nadsec_last_seen": "2026-05-31T03:36:17.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--dba8ddd9-2a58-4bf2-9981-d83597d80d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.25.2.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T03:19:32.597Z",
      "x_nadsec_last_seen": "2026-05-31T03:21:37.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--f34b6ca7-0012-4522-9e10-a27d6fba3510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '181.21.208.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T04:02:43.775Z",
      "x_nadsec_last_seen": "2026-05-31T04:10:06.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--279ac3bc-3d19-46f3-9a97-0bc2db9c937f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T03:15:07.108Z",
      "x_nadsec_last_seen": "2026-05-31T03:15:07.108Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--15cba6a2-d65e-4666-8ac7-c63308f2bf72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.118.240.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T04:00:05.961Z",
      "x_nadsec_last_seen": "2026-05-31T04:00:05.961Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd",
      "id": "indicator--6f464778-0901-40f9-a286-932c92bcfb6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.99.184.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-10T17:52:01.691Z",
      "x_nadsec_last_seen": "2026-05-31T03:18:51.497Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "402253"
      ],
      "x_nadsec_orgs": [
        "SKN Subnet & Telecom Ltd"
      ]
    },
    {
      "created": "2026-05-31T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--0fa1889e-52db-44d0-87fe-90e53883b050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.99.245.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:05:12.000Z",
      "valid_until": "2026-07-02T04:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T03:26:28.183Z",
      "x_nadsec_last_seen": "2026-05-31T03:28:34.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3b848875-f37a-4223-b175-1fd6a59fbb39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.165.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T04:27:14.435Z",
      "x_nadsec_last_seen": "2026-05-31T04:27:25.701Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--66c2b666-febb-45c9-9070-0d6ef925b210",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.247.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T04:27:26.350Z",
      "x_nadsec_last_seen": "2026-05-31T04:27:26.350Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.",
      "id": "indicator--e7bda2a7-cef8-45e2-9bb0-d639f46cd142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.189.58.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T04:08:59.739Z",
      "x_nadsec_last_seen": "2026-05-31T04:09:05.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "17072"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--346c1fcb-2d6d-4c4d-a5fd-94cea28cb357",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.90.97.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T04:14:24.343Z",
      "x_nadsec_last_seen": "2026-05-31T04:16:30.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b6827298-50ba-4643-b521-2f7b03db514c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T04:53:08.490Z",
      "x_nadsec_last_seen": "2026-05-31T04:53:08.490Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b611c30a-872b-45b7-a532-a8363f20cf52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T04:19:50.807Z",
      "x_nadsec_last_seen": "2026-05-31T04:19:50.807Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--5b698d49-cb21-45d6-9d60-f7259895c9b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.143.220.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-31T04:47:55.643Z",
      "x_nadsec_last_seen": "2026-05-31T04:51:30.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--81398d91-9d37-40c6-910d-c38413ee49bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.65.107.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T04:37:27.353Z",
      "x_nadsec_last_seen": "2026-05-31T04:39:32.833Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-05-31T05:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--bc15da62-630a-435e-8a52-97c08210d0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T05:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.162.152.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:05:10.000Z",
      "valid_until": "2026-07-02T05:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T05:00:06.795Z",
      "x_nadsec_last_seen": "2026-05-31T05:07:06.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--a50913fb-b8cd-4a79-8038-fd22a95c2008",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.78.138.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T05:59:48.963Z",
      "x_nadsec_last_seen": "2026-05-31T06:01:54.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--b2af1739-b9ea-4913-bef1-042c1332ee42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.189.213.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T05:35:11.476Z",
      "x_nadsec_last_seen": "2026-05-31T05:35:11.476Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=62040; asn_org=Innovative Telecommunications LLC",
      "id": "indicator--d2f3f820-5cef-4b32-9d54-bdeb755d387a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.14.4.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T05:48:56.214Z",
      "x_nadsec_last_seen": "2026-05-31T05:51:02.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "62040"
      ],
      "x_nadsec_orgs": [
        "Innovative Telecommunications LLC"
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T05:40:15.697Z",
      "x_nadsec_last_seen": "2026-05-31T05:40:15.697Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--e3c55c18-aac4-41e5-9636-95b3dc104146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '32.199.170.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T05:34:16.015Z",
      "x_nadsec_last_seen": "2026-05-31T05:34:16.015Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--0a500bc8-a868-42af-9f7f-f4272fdceaff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-31T06:04:42.785Z",
      "x_nadsec_last_seen": "2026-05-31T06:05:13.469Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=62468; asn_org=VpsQuan L.L.C.",
      "id": "indicator--3a2a9a89-6468-4873-a1bb-914649eba072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '69.165.75.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-28T20:07:48.354Z",
      "x_nadsec_last_seen": "2026-05-31T05:28:21.516Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "62468"
      ],
      "x_nadsec_orgs": [
        "VpsQuan L.L.C."
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--88ab386b-319d-4876-a81e-24cf9706edb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T05:30:40.694Z",
      "x_nadsec_last_seen": "2026-05-31T05:30:51.106Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-31T06:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GE; asn=44327; asn_org=Delta Comm LLC",
      "id": "indicator--c4586dd1-428c-4eac-b95e-fb125a35e5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T06:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.51.101.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T06:05:04.000Z",
      "valid_until": "2026-07-02T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T05:56:03.568Z",
      "x_nadsec_last_seen": "2026-05-31T05:56:03.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "44327"
      ],
      "x_nadsec_orgs": [
        "Delta Comm LLC"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45184; asn_org=Den Digital Entertainment Pvt. Ltd. AS ISP india",
      "id": "indicator--44f49992-3c0b-4ef1-abea-6d8343d74c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.61.113.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T06:55:46.173Z",
      "x_nadsec_last_seen": "2026-05-31T06:57:51.378Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45184"
      ],
      "x_nadsec_orgs": [
        "Den Digital Entertainment Pvt. Ltd. AS ISP india"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=133594; asn_org=World Phone Infrastructure services private ltd",
      "id": "indicator--801a6f21-ea4f-4df1-a892-808dc1781d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.235.64.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T06:54:02.039Z",
      "x_nadsec_last_seen": "2026-05-31T06:54:02.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133594"
      ],
      "x_nadsec_orgs": [
        "World Phone Infrastructure services private ltd"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b2c2671f-d671-49ad-96fb-b09971b95d29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.177.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T06:11:52.824Z",
      "x_nadsec_last_seen": "2026-05-31T06:11:52.824Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--7ac4cd6f-c46a-4b7c-94e5-0c3db926544d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.56.226.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T06:05:52.619Z",
      "x_nadsec_last_seen": "2026-05-31T06:06:48.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--997566b1-263e-480d-b9ef-3fd2263ef472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T06:55:47.114Z",
      "x_nadsec_last_seen": "2026-05-31T06:55:57.433Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e6119f5e-5d3a-41ee-9422-3097e0b143ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.134.137.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T06:46:38.146Z",
      "x_nadsec_last_seen": "2026-05-31T06:46:43.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8ab513d9-5355-42bc-9d20-ac752da93658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.24.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T07:00:53.763Z",
      "x_nadsec_last_seen": "2026-05-31T07:01:37.821Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "I*****@"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--45e731e0-09de-4e3c-8ae3-5fb768947acb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.38.215.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T07:00:32.993Z",
      "x_nadsec_last_seen": "2026-05-31T07:00:32.993Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--92b101c8-f419-44f3-b7b2-587e2bf497ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.76.124.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T07:01:22.522Z",
      "x_nadsec_last_seen": "2026-05-31T07:01:23.398Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--27d25e15-32be-4fb8-880c-7e8f7b8d6ea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T06:32:43.983Z",
      "x_nadsec_last_seen": "2026-05-31T06:32:43.983Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-31T07:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T07:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:05:10.000Z",
      "valid_until": "2026-07-02T07:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T06:32:43.595Z",
      "x_nadsec_last_seen": "2026-05-31T06:32:43.595Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-05-31T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=138277; asn_org=Radinet Info Solutions Private Limited",
      "id": "indicator--acf0658c-57d8-4aea-a53f-30508f797868",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.170.68.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:05:10.000Z",
      "valid_until": "2026-07-02T08:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T08:03:51.286Z",
      "x_nadsec_last_seen": "2026-05-31T08:03:51.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138277"
      ],
      "x_nadsec_orgs": [
        "Radinet Info Solutions Private Limited"
      ]
    },
    {
      "created": "2026-05-31T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--0043a4a1-1e79-4a61-9d3c-fd72b61968dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.238.194.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:05:10.000Z",
      "valid_until": "2026-07-02T08:05:09.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-05-31T07:26:16.156Z",
      "x_nadsec_last_seen": "2026-05-31T08:38:07.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-31T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--525d7579-60e1-4556-9482-a0d5cde7138b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.116.154.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:05:10.000Z",
      "valid_until": "2026-07-02T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T07:57:31.777Z",
      "x_nadsec_last_seen": "2026-05-31T07:57:32.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-31T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--d35099bc-9f59-4d81-90ed-a9e8fbe6580e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.225.185.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:05:10.000Z",
      "valid_until": "2026-07-02T08:05:09.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-05-31T08:01:41.304Z",
      "x_nadsec_last_seen": "2026-05-31T08:04:09.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-05-31T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=24; services=mqttd; ports=1883; cc=RO; asn=42397; asn_org=Bunea TELECOM SRL",
      "id": "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.29.13.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:05:10.000Z",
      "valid_until": "2026-07-02T08:05:09.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-05-31T07:22:58.141Z",
      "x_nadsec_last_seen": "2026-05-31T07:24:38.748Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "1883",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mqttd",
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "42397"
      ],
      "x_nadsec_orgs": [
        "Bunea TELECOM SRL"
      ]
    },
    {
      "created": "2026-05-31T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1b88c49e-80f0-4e3f-b8b1-5867775055e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.202.8.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:05:10.000Z",
      "valid_until": "2026-07-02T08:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T07:43:18.108Z",
      "x_nadsec_last_seen": "2026-05-31T07:43:18.216Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-31T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=36923; asn_org=SWIFTNG-ASN",
      "id": "indicator--2ec5e1f2-58ce-45fb-85da-32a60942a97a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.221.168.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T08:05:10.000Z",
      "valid_until": "2026-07-02T08:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T07:23:04.998Z",
      "x_nadsec_last_seen": "2026-05-31T07:23:11.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36923"
      ],
      "x_nadsec_orgs": [
        "SWIFTNG-ASN"
      ]
    },
    {
      "created": "2026-05-31T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=45925; asn_org=ASN For Teletalk Bangladesh Ltd.",
      "id": "indicator--ba9abb90-ed2f-4571-8b05-2d8330ff80d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.230.107.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:05:10.000Z",
      "valid_until": "2026-07-02T09:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T08:42:33.448Z",
      "x_nadsec_last_seen": "2026-05-31T08:47:31.950Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45925"
      ],
      "x_nadsec_orgs": [
        "ASN For Teletalk Bangladesh Ltd."
      ]
    },
    {
      "created": "2026-05-31T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=56272; asn_org=Pulse Telesystems Pvt Ltd",
      "id": "indicator--e96eebbf-6e8d-4095-a4f1-386e019b9e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.249.80.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:05:10.000Z",
      "valid_until": "2026-07-02T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T08:32:44.175Z",
      "x_nadsec_last_seen": "2026-05-31T08:35:17.493Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "56272"
      ],
      "x_nadsec_orgs": [
        "Pulse Telesystems Pvt Ltd"
      ]
    },
    {
      "created": "2026-05-31T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--dc450676-75a4-42a5-bac6-f11b1b8fe343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.229.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:05:10.000Z",
      "valid_until": "2026-07-02T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T08:51:05.781Z",
      "x_nadsec_last_seen": "2026-05-31T08:51:09.017Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--087dc3ef-7fcd-413f-81bc-67ed87ad4eb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:05:10.000Z",
      "valid_until": "2026-07-02T09:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T08:59:31.498Z",
      "x_nadsec_last_seen": "2026-05-31T09:00:01.499Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-05-31T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53142; asn_org=Friburgo Online LTDA ME",
      "id": "indicator--65801a64-9a80-4a71-9b78-1e1016e3cf55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '191.240.254.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:05:10.000Z",
      "valid_until": "2026-07-02T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T08:36:58.819Z",
      "x_nadsec_last_seen": "2026-05-31T08:39:05.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53142"
      ],
      "x_nadsec_orgs": [
        "Friburgo Online LTDA ME"
      ]
    },
    {
      "created": "2026-05-31T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--a2214726-6cb0-4622-a4c8-dcff5c8143b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.210.79.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:05:10.000Z",
      "valid_until": "2026-07-02T09:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T08:24:02.747Z",
      "x_nadsec_last_seen": "2026-05-31T14:42:10.007Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f13569e5-99ca-4c96-9ab2-3bb73e7e7fcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.177.86.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T09:20:52.169Z",
      "x_nadsec_last_seen": "2026-05-31T09:25:22.775Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--701d1d15-08ad-4d78-b954-e0a2e9fc4774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '168.144.67.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T09:53:25.306Z",
      "x_nadsec_last_seen": "2026-05-31T09:53:25.306Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--1a3f94ac-1c99-43de-821d-4587cfda7b0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.72.87.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T09:07:25.232Z",
      "x_nadsec_last_seen": "2026-05-31T09:15:13.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=215125; asn_org=Church of Cyberology",
      "id": "indicator--fffc992e-8a59-4c6d-8fa7-65b315c63804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T09:56:10.099Z",
      "x_nadsec_last_seen": "2026-05-31T09:56:10.099Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "215125"
      ],
      "x_nadsec_orgs": [
        "Church of Cyberology"
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--689d27bf-86ff-466b-a301-a5cae01ee7b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.156.237.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T09:51:18.336Z",
      "x_nadsec_last_seen": "2026-05-31T09:51:18.336Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.230.221.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T09:57:38.782Z",
      "x_nadsec_last_seen": "2026-05-31T09:57:38.782Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=55836; asn_org=Reliance Jio Infocomm Limited",
      "id": "indicator--4451fc7b-8d49-4eeb-8077-a34327ca0465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '49.43.90.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T10:03:54.102Z",
      "x_nadsec_last_seen": "2026-05-31T10:03:54.301Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55836"
      ],
      "x_nadsec_orgs": [
        "Reliance Jio Infocomm Limited"
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8d269a83-5f66-4db6-8eb8-eb2c10a0d6c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T09:34:54.701Z",
      "x_nadsec_last_seen": "2026-05-31T09:34:54.701Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-31T10:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--9c2baa02-3edd-4ce2-a57d-3c3c33d4cd88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T10:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T10:05:11.000Z",
      "valid_until": "2026-07-02T10:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T09:42:42.410Z",
      "x_nadsec_last_seen": "2026-05-31T14:08:18.272Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-05-31T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=pptpd; ports=1723; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--6ce3a868-928e-4c0f-92eb-4286132a49d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:05:10.000Z",
      "valid_until": "2026-07-02T11:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T10:34:49.243Z",
      "x_nadsec_last_seen": "2026-05-31T10:35:10.750Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "445",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-05-31T11:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--ddea1711-d78c-4a43-a12d-ac556498231b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T11:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.248.32.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T11:05:10.000Z",
      "valid_until": "2026-07-02T11:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-31T10:55:35.100Z",
      "x_nadsec_last_seen": "2026-05-31T12:12:04.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--26772517-d9af-4287-86c8-7ae2b129db0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.248.127.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T11:06:24.385Z",
      "x_nadsec_last_seen": "2026-05-31T11:11:08.445Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--aa9aa233-a5cd-42ae-90e6-0713e10b3af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T11:57:46.159Z",
      "x_nadsec_last_seen": "2026-05-31T11:57:57.959Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--3c268658-eba8-4d96-8d7a-0640fb16125c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T11:32:20.703Z",
      "x_nadsec_last_seen": "2026-05-31T11:32:20.703Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=136190; asn_org=JINHUA, ZHEJIANG Province, P.R.China.",
      "id": "indicator--f660c869-fe96-4b8d-8e4d-abeed329415f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.188.24.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T11:38:45.607Z",
      "x_nadsec_last_seen": "2026-05-31T11:38:45.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136190"
      ],
      "x_nadsec_orgs": [
        "JINHUA, ZHEJIANG Province, P.R.China."
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--00c84f93-4d9f-435a-8476-6f92aa8de056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.146.236.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T11:31:02.863Z",
      "x_nadsec_last_seen": "2026-05-31T11:33:08.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--4d47bab5-84ba-4269-8160-92cafd4a1457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.186.213.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T11:51:04.720Z",
      "x_nadsec_last_seen": "2026-05-31T11:57:08.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f4004b12-5c33-4b45-a76e-9280014061f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.30.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T11:45:23.715Z",
      "x_nadsec_last_seen": "2026-05-31T11:45:24.295Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--28059ef0-e53b-4d01-aeb0-c8f96c7e34aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.28.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T12:05:11.000Z",
      "valid_until": "2026-07-02T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T11:31:14.618Z",
      "x_nadsec_last_seen": "2026-05-31T11:31:38.300Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-31T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mssqld; ports=1433; cc=CN; asn=55933; asn_org=Cloudie Limited; user(top)=**; pass(top)=1****6",
      "id": "indicator--29becdfc-0443-45f2-b245-687a3f8c4de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.115.64.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:05:11.000Z",
      "valid_until": "2026-07-02T13:05:09.000Z",
      "x_nadsec_event_count": 27,
      "x_nadsec_first_seen": "2026-05-31T12:57:04.994Z",
      "x_nadsec_last_seen": "2026-05-31T13:20:52.879Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "55933"
      ],
      "x_nadsec_orgs": [
        "Cloudie Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "k******n",
        "**",
        "b**a"
      ],
      "x_nadsec_passwords_attempted": [
        "**",
        "1****6",
        "***",
        "*",
        "A*******3"
      ]
    },
    {
      "created": "2026-05-31T13:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--d1c5b09a-13ac-4c3a-8410-260df1212763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T13:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.214.184.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:05:11.000Z",
      "valid_until": "2026-07-02T13:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T12:39:40.981Z",
      "x_nadsec_last_seen": "2026-05-31T12:41:50.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "58224"
      ],
      "x_nadsec_orgs": [
        "Iran Telecommunication Company PJS"
      ]
    },
    {
      "created": "2026-05-31T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TN; asn=37705; asn_org=TOPNET; user(top)=**",
      "id": "indicator--3b2c6f67-b10c-4633-a6e1-e5dd10ebd70f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.156.186.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:05:11.000Z",
      "valid_until": "2026-07-02T14:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T14:01:40.253Z",
      "x_nadsec_last_seen": "2026-05-31T14:01:40.253Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-31T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1f1ae56b-bdf7-4db0-86a3-d21fc2b65c63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.167.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:05:11.000Z",
      "valid_until": "2026-07-02T14:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T13:53:36.683Z",
      "x_nadsec_last_seen": "2026-05-31T14:00:16.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-31T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--6e534859-cb57-44a1-86a6-d46493556f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.241.112.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:05:11.000Z",
      "valid_until": "2026-07-02T14:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T13:18:16.203Z",
      "x_nadsec_last_seen": "2026-05-31T13:18:43.217Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-31T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--87e1db3c-5dd7-4f8f-a275-7ad6aeb3143d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '154.255.13.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:05:11.000Z",
      "valid_until": "2026-07-02T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T13:21:22.001Z",
      "x_nadsec_last_seen": "2026-05-31T13:23:28.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-05-31T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--ae636ef5-7d88-4dc6-9e19-0eecbe7e75b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.49.97.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:05:11.000Z",
      "valid_until": "2026-07-02T14:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T13:38:51.663Z",
      "x_nadsec_last_seen": "2026-05-31T13:40:56.050Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-05-31T14:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--1a04471f-7e8d-4712-a8e6-eeb57baa389f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T14:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:05:11.000Z",
      "valid_until": "2026-07-02T14:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T13:14:49.825Z",
      "x_nadsec_last_seen": "2026-05-31T13:14:50.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--43bc1f97-080c-4f44-850e-d839e27d2c0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.83.125.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T14:36:51.764Z",
      "x_nadsec_last_seen": "2026-05-31T14:36:51.764Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--24883be8-5273-4281-ae70-7ac8f491a958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.19.188.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T14:59:18.899Z",
      "x_nadsec_last_seen": "2026-05-31T15:01:23.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RO; asn=12302; asn_org=Vodafone Romania S.A.",
      "id": "indicator--696e249a-873f-4c88-b2e8-a62cce7ab97b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.255.131.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T15:01:10.614Z",
      "x_nadsec_last_seen": "2026-05-31T15:03:16.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "12302"
      ],
      "x_nadsec_orgs": [
        "Vodafone Romania S.A."
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--cffed29c-ba0c-4f1d-b054-f990229a3a41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.225.235.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T14:11:12.593Z",
      "x_nadsec_last_seen": "2026-05-31T14:15:06.114Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--27803893-2a9e-42c0-be92-9e86e0fec10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.39.61.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T14:48:02.512Z",
      "x_nadsec_last_seen": "2026-05-31T14:48:02.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e314a1a9-8479-48b7-b96e-29eec4562aca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T15:02:27.440Z",
      "x_nadsec_last_seen": "2026-05-31T15:02:27.791Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--7d13ebdf-6590-4c39-affe-5d83cee1b10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.135.20.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-05-31T14:44:25.669Z",
      "x_nadsec_last_seen": "2026-05-31T17:12:01.526Z",
      "x_nadsec_ports": [
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--38171049-92c5-4d42-9a76-c1294ab3d593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '41.38.113.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-05-20T08:23:17.448Z",
      "x_nadsec_last_seen": "2026-05-31T14:54:22.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T14:31:46.637Z",
      "x_nadsec_last_seen": "2026-05-31T14:31:46.637Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=31619; asn_org=City Stars",
      "id": "indicator--c640580c-383a-481c-af3f-c8a1d25269ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.205.106.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T14:52:06.846Z",
      "x_nadsec_last_seen": "2026-05-31T14:52:57.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "31619"
      ],
      "x_nadsec_orgs": [
        "City Stars"
      ]
    },
    {
      "created": "2026-05-31T15:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=44143; asn_org=A1 Srbija d.o.o. Beograd",
      "id": "indicator--d47c865e-75bd-4a0b-8f13-9891dd8f3953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T15:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.86.4.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T15:05:10.000Z",
      "valid_until": "2026-07-02T15:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T14:28:24.846Z",
      "x_nadsec_last_seen": "2026-05-31T14:30:31.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "44143"
      ],
      "x_nadsec_orgs": [
        "A1 Srbija d.o.o. Beograd"
      ]
    },
    {
      "created": "2026-05-31T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d4350190-69e8-42e9-8705-8912a44c02b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:05:10.000Z",
      "valid_until": "2026-07-02T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T15:49:04.112Z",
      "x_nadsec_last_seen": "2026-05-31T15:49:04.112Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-31T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--b49141f3-d7e7-4f7b-b1ee-f1ef1d3904ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:05:10.000Z",
      "valid_until": "2026-07-02T16:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-05-22T21:48:07.912Z",
      "x_nadsec_last_seen": "2026-05-31T15:46:51.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-05-31T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--044cbf55-dca4-4e17-8306-7a447c9a3e3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:05:10.000Z",
      "valid_until": "2026-07-02T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T15:47:26.415Z",
      "x_nadsec_last_seen": "2026-05-31T15:47:26.415Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-05-31T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--861762b0-bfd7-499c-a0fc-f7762621dfc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:05:10.000Z",
      "valid_until": "2026-07-02T16:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T15:36:06.149Z",
      "x_nadsec_last_seen": "2026-05-31T15:36:16.308Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-05-31T16:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7fd54a9f-8977-4304-bc62-af73db169f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T16:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.220.105.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T16:05:10.000Z",
      "valid_until": "2026-07-02T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T15:58:59.114Z",
      "x_nadsec_last_seen": "2026-05-31T16:01:05.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3c55ef4d-6680-4cba-b816-0dda62ac3100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.72.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T16:37:07.497Z",
      "x_nadsec_last_seen": "2026-05-31T16:37:07.497Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--82c117b1-10e4-49c3-9dde-572f15a4fa7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.6.207.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T16:45:52.104Z",
      "x_nadsec_last_seen": "2026-05-31T16:45:52.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27964; asn_org=RSO APOLO HIDALGO S.R.L.",
      "id": "indicator--99c29f3b-fcb7-429e-ba40-6a125cd5591d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.4.107.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T16:55:18.584Z",
      "x_nadsec_last_seen": "2026-05-31T17:02:13.153Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27964"
      ],
      "x_nadsec_orgs": [
        "RSO APOLO HIDALGO S.R.L."
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LT; asn=8764; asn_org=Telia Lietuva, AB",
      "id": "indicator--3dbe1135-2998-4969-a1dd-c45b39f42f25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.69.23.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T16:34:57.768Z",
      "x_nadsec_last_seen": "2026-05-31T16:37:04.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "8764"
      ],
      "x_nadsec_orgs": [
        "Telia Lietuva, AB"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--3920e92d-bc1e-4dc2-8e5b-ab61247e43d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.188.57.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-05-31T16:42:17.790Z",
      "x_nadsec_last_seen": "2026-05-31T19:11:50.166Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=3741; asn_org=NTT-DATA-Inc",
      "id": "indicator--48ad820d-0ef4-495f-8514-9cfbc5139151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '196.33.226.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T16:14:10.228Z",
      "x_nadsec_last_seen": "2026-05-31T16:14:10.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "3741"
      ],
      "x_nadsec_orgs": [
        "NTT-DATA-Inc"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--a491b86b-e944-4e6b-85e3-32940586a1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '197.210.8.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T16:32:54.217Z",
      "x_nadsec_last_seen": "2026-05-31T16:35:01.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--93a004db-cf6c-4161-8c97-0baa802327eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.206.138.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T16:48:44.500Z",
      "x_nadsec_last_seen": "2026-05-31T16:50:48.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--bc593a93-492b-439c-924b-0488e70c8f67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.16.79.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T16:21:49.635Z",
      "x_nadsec_last_seen": "2026-05-31T16:24:29.219Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PL; asn=12741; asn_org=Netia SA",
      "id": "indicator--26406a51-9c03-4993-890e-0a6ae256c54c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.233.166.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:05:14.000Z",
      "valid_until": "2026-07-02T17:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T17:00:37.867Z",
      "x_nadsec_last_seen": "2026-05-31T17:02:44.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "12741"
      ],
      "x_nadsec_orgs": [
        "Netia SA"
      ]
    },
    {
      "created": "2026-05-31T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--b2d0e7c8-ad42-4ef1-b050-2bcdb176eaeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.58.154.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:05:10.000Z",
      "valid_until": "2026-07-02T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T17:27:32.448Z",
      "x_nadsec_last_seen": "2026-05-31T17:29:37.415Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-05-31T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.",
      "id": "indicator--c7904438-0531-4eb8-90dc-411e677d9596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.230.249.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:05:10.000Z",
      "valid_until": "2026-07-02T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T17:27:36.060Z",
      "x_nadsec_last_seen": "2026-05-31T17:27:37.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."
      ]
    },
    {
      "created": "2026-05-31T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--12db5d2f-df0c-4ad5-9e22-ac8eb5611d4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.5.75.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:05:10.000Z",
      "valid_until": "2026-07-02T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T17:36:02.559Z",
      "x_nadsec_last_seen": "2026-05-31T17:38:07.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-05-31T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=JP; asn=132203; asn_org=Tencent Building, Kejizhongyi Avenue; user(top)=**",
      "id": "indicator--467af180-31e5-418d-bbe1-29ea089e4574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.130.244.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:05:10.000Z",
      "valid_until": "2026-07-02T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T17:14:29.481Z",
      "x_nadsec_last_seen": "2026-05-31T17:14:29.992Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "132203"
      ],
      "x_nadsec_orgs": [
        "Tencent Building, Kejizhongyi Avenue"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-31T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e7dca12f-44fc-4b50-b156-9873221f348e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.254.169.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:05:10.000Z",
      "valid_until": "2026-07-02T18:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T17:54:30.747Z",
      "x_nadsec_last_seen": "2026-05-31T17:54:54.849Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-05-31T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--50a8de5f-3d07-4bd2-984e-d5c97d575021",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.15.68.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:05:10.000Z",
      "valid_until": "2026-07-02T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T17:50:30.063Z",
      "x_nadsec_last_seen": "2026-05-31T17:55:39.045Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--0994d90a-d181-468e-9a41-c8e20965d175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.236.227.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T18:08:48.228Z",
      "x_nadsec_last_seen": "2026-05-31T18:10:52.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e2035372-83d0-4bef-bf06-052439dac9cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.56.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-05-31T18:17:15.757Z",
      "x_nadsec_last_seen": "2026-05-31T18:17:36.503Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6388b17c-e9af-426b-9ad5-327b5021b6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.241.87.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T18:07:36.922Z",
      "x_nadsec_last_seen": "2026-05-31T18:09:41.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--cb630de5-e04e-469f-b77a-84dc257473a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T18:08:27.282Z",
      "x_nadsec_last_seen": "2026-05-31T18:08:57.158Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--77cfed09-a65a-43ae-918f-652bfd1d104a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '189.152.160.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T18:59:45.422Z",
      "x_nadsec_last_seen": "2026-05-31T19:01:50.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=6849; asn_org=JSC Ukrtelecom",
      "id": "indicator--e51bf591-61c6-4386-88b9-b4240b2a7423",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.55.217.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T18:40:52.205Z",
      "x_nadsec_last_seen": "2026-05-31T18:42:58.759Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6849"
      ],
      "x_nadsec_orgs": [
        "JSC Ukrtelecom"
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9aa33267-ad50-4077-8288-92bb8584a304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.141.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T18:11:35.595Z",
      "x_nadsec_last_seen": "2026-05-31T18:11:35.595Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T19:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--856c9e19-a57e-46dd-b357-d7555848a2aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T19:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:05:11.000Z",
      "valid_until": "2026-07-02T19:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T18:45:37.062Z",
      "x_nadsec_last_seen": "2026-05-31T18:45:37.062Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=58563; asn_org=CHINANET Hubei province network",
      "id": "indicator--3edb8c59-23fe-4366-8639-40173e30cc23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.96.55.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T20:27:44.179Z",
      "x_nadsec_last_seen": "2026-05-31T20:30:20.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58563"
      ],
      "x_nadsec_orgs": [
        "CHINANET Hubei province network"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b8c02af2-9a1d-4f81-a70f-1085dbe40ccf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.164.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T20:32:22.174Z",
      "x_nadsec_last_seen": "2026-05-31T20:32:23.279Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e134a606-ce39-48ca-b36b-34f7b0548f90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.159.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T20:32:14.938Z",
      "x_nadsec_last_seen": "2026-05-31T20:32:14.938Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=58461; asn_org=CT-HangZhou-IDC",
      "id": "indicator--649a04ad-78c7-43f2-8eaf-92ab9678fd80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.134.89.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T20:35:40.460Z",
      "x_nadsec_last_seen": "2026-05-31T20:35:40.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58461"
      ],
      "x_nadsec_orgs": [
        "CT-HangZhou-IDC"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6b0da8bc-1783-498f-aea6-3fb99a4a9a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-05-31T21:00:59.099Z",
      "x_nadsec_last_seen": "2026-05-31T21:00:59.099Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=201250; asn_org=OOO SET",
      "id": "indicator--3bb54411-21f2-4777-a4a4-396203066ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.59.134.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T20:25:03.073Z",
      "x_nadsec_last_seen": "2026-05-31T20:27:09.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "201250"
      ],
      "x_nadsec_orgs": [
        "OOO SET"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--85d1793a-8ccf-48c5-8fd6-ec87668cb5c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.220.55.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T20:52:24.206Z",
      "x_nadsec_last_seen": "2026-05-31T20:58:51.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--6a6df85f-1ae3-4665-a570-9bd882faae27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.101.9.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-05-31T20:44:14.059Z",
      "x_nadsec_last_seen": "2026-05-31T22:14:24.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-05-31T21:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--431f9741-0ef0-41f3-ae78-5ba1c7a496e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T21:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '90.188.42.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T21:05:11.000Z",
      "valid_until": "2026-07-02T21:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-05-31T20:40:26.983Z",
      "x_nadsec_last_seen": "2026-05-31T20:42:34.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-05-31T22:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=42495; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9ca33123-5392-449b-a8ba-0404cebfe330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-05-31T22:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:05:10.000Z",
      "valid_until": "2026-07-02T22:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-05-31T21:09:07.946Z",
      "x_nadsec_last_seen": "2026-05-31T21:09:07.948Z",
      "x_nadsec_ports": [
        "42",
        "42495"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-05-31T23:56:22Z",
    "enricher": "enrich_stix_dionaea.py",
    "month": "2026-05",
    "es_host": "http://127.0.0.1:64298",
    "ip_count": 5846,
    "hash_count": 0,
    "enriched_count": 5752
  },
  "x_mitre_attack": {
    "techniques": {
      "T1021.002": {
        "name": "Remote Services: SMB/Windows Admin Shares",
        "tactic": "Lateral Movement",
        "ip_count": 3930,
        "sample_services": []
      },
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "ip_count": 1030,
        "sample_services": []
      },
      "T1110": {
        "name": "Brute Force",
        "tactic": "Credential Access",
        "ip_count": 448,
        "sample_services": []
      },
      "T1133": {
        "name": "External Remote Services",
        "tactic": "Initial Access",
        "ip_count": 297,
        "sample_services": []
      }
    },
    "tactic_summary": {
      "Lateral Movement": 3930,
      "Initial Access": 1327,
      "Credential Access": 448
    },
    "technique_count": 4,
    "primary_tactics": [
      "Lateral Movement",
      "Initial Access",
      "Credential Access"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 5752,
    "scored_ips": 5752,
    "threat_distribution": {
      "critical": 566,
      "high": 589,
      "medium": 478,
      "low": 1349,
      "minimal": 2770,
      "unknown": 0
    },
    "avg_threat_score": 31.7,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "92.63.197.22",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "51.68.207.118",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "5.61.209.224",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.149.2",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.149.62",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.149.74",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.149.35",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.149.39",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "115.231.78.11",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.149.9",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.140.48",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.140.18",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.82.78.105",
        "threat_score": 99.7,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "77.83.240.70",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.82.78.107",
        "threat_score": 98.8,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.82.78.106",
        "threat_score": 98.7,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.20.66",
        "threat_score": 98.6,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.82.78.100",
        "threat_score": 98.1,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      }
    ]
  }
}